docs: refresh auth docs for Bunyip-SSO-only (LC-22) + document dev-web SSO setup #364
Loading…
Reference in a new issue
No description provided.
Delete branch "docs/dev-web-bunyip-sso-setup"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why
After the LC-22 pure-RP Bunyip cutover, several docs still described the retired local-auth model (registration, username/password login, password reset, email verification, 2FA/TOTP). They are now wrong, and the
just dev-webSSO setup was undocumented (it cost a long debugging session to rediscover). This brings the docs in line with reality.Changes (docs only)
LETS_CHAT_BUNYIP_SSO_*vars; first SSO user becomes Admin.LETS_CHAT_BUNYIP_SSO_INSECURE_TLS; drops 2FA/password-reset framing fromLETS_CHAT_SECRET_KEYandLETS_CHAT_BASE_URL.LETS_CHAT_SECRET_KEYsection: drops the 2FA recovery notes (now Web Push + sealed IMAP password).emailclaim; no password-reset/email-verification flow.just dev-webprerequisites (register a lets-chat OIDC client on the dev Bunyip OP with the per-developer dev redirect; add${USER}-chat.a8n.runto/etc/hostsso it resolves over the Nebula overlay).LETS_CHAT_BUNYIP_SSO_*section + dev-only insecure-TLS flag; SMTP re-framed as digest + mention/DM notifications.LETS_CHAT_SECRET_KEYrow drops TOTP; the test-harnessenforce_2fa_enrollment/totp_enabled = 1gotcha marked a retired no-op (middleware deleted), legacytotp_*columns noted as still present.No code or behavior change.
The README, .env.standalone, CLAUDE.md, and docs/email-ingress.md still described the pre-LC-22 local-auth model (registration, username/password login, password reset, email verification, 2FA/TOTP), none of which exist after the pure-RP Bunyip cutover. Bring them in line with reality and capture the dev-web SSO setup that was undocumented. README: feature list now states SSO is the sole auth path (no local auth/2FA); the Docker quick start sets the four mandatory `LETS_CHAT_BUNYIP_SSO_*` vars and notes the first SSO user becomes Admin; the env table adds the SSO vars and the dev-only insecure-TLS flag and drops 2FA/password-reset framing from `LETS_CHAT_SECRET_KEY` and `LETS_CHAT_BASE_URL`; the `LETS_CHAT_SECRET_KEY` section drops the 2FA recovery notes; the digest section drops password-reset/email-verification references (email now comes from the SSO `email` claim). Local Development gains a `just dev-web` prerequisites block: register a lets-chat OIDC client on the dev Bunyip OP with the per-developer dev redirect, and add `${USER}-chat.a8n.run` to `/etc/hosts` so the browser resolves it over the Nebula overlay. .env.standalone: replaces the local-auth preamble with the Bunyip SSO model, adds a required `LETS_CHAT_BUNYIP_SSO_*` section plus the dev-only insecure-TLS flag, and re-frames SMTP as digest + mention/DM notifications (no password-reset mail). CLAUDE.md: Auth & Sessions now describes SSO-only auth and first-SSO-user promotion; the `LETS_CHAT_SECRET_KEY` row drops TOTP; the test-harness gotcha marks the `enforce_2fa_enrollment` / `totp_enabled = 1` workaround as a retired no-op (the middleware was deleted) while noting the legacy `totp_*` columns persist. docs/email-ingress.md: corrects the "existing email surfaces" list to the mail surfaces that still exist. Docs only; no code or behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>