psa-systems/mokosh-server
Watch
9
0
Fork
You've already forked mokosh-server
 1
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

docs(auth): clarify SSO startup log + record PMS-291 posture decision #229

Merged
YousifShkara merged 1 commit from fix/pms-291-sso-log-and-docs into main 2026-06-14 04:53:35 +02:00
Conversation 0 Commits 1 Files changed 3 +22 -9
YousifShkara commented 2026-06-14 04:53:31 +02:00
Owner
Copy link

Two PMS-291 ACs in one PR (docs + log only, no behaviour change):

  1. The SsoSetup::NotConfigured WARN no longer implies the server fell back to legacy auth. The earlier "the server will run with legacy auth only" was misleading: it suggested mechanism 3 (HS256 cookie) was now the only path, when in fact the bunyip-as-OP Resource-Server path (mechanism 1, OIDC_ISSUER + OIDC_AUDIENCE) is the one the SPA + E2E actually use and is unaffected by mokosh-auth not mounting. The new wording names both surviving paths and explains that only mokosh's own /oauth2/* endpoints are unavailable.

  2. CLAUDE.md "Auth: two systems coexist" rewritten as "Auth: three independent mechanisms" so the bunyip-RS path is documented alongside mokosh-auth and the legacy HS256 cookie path. Adds the PMS-291 posture decision (B-now / A-later per PMS-292 / PMS-295), the hard prerequisite that the Ed25519 keypair must already exist in MOKOSH_AUTH_JWT_PRIVATE_KEY_PATH / MOKOSH_AUTH_JWT_PUBLIC_KEYS_DIR before first start (PMS-289 made a missing key set fatal), and the planned removal of mechanism 2 once PMS-295 lands.

#PMS-291

Two PMS-291 ACs in one PR (docs + log only, no behaviour change): 1. The SsoSetup::NotConfigured WARN no longer implies the server fell back to legacy auth. The earlier "the server will run with legacy auth only" was misleading: it suggested mechanism 3 (HS256 cookie) was now the only path, when in fact the bunyip-as-OP Resource-Server path (mechanism 1, OIDC_ISSUER + OIDC_AUDIENCE) is the one the SPA + E2E actually use and is unaffected by mokosh-auth not mounting. The new wording names both surviving paths and explains that only mokosh's own /oauth2/* endpoints are unavailable. 2. CLAUDE.md "Auth: two systems coexist" rewritten as "Auth: three independent mechanisms" so the bunyip-RS path is documented alongside mokosh-auth and the legacy HS256 cookie path. Adds the PMS-291 posture decision (B-now / A-later per PMS-292 / PMS-295), the hard prerequisite that the Ed25519 keypair must already exist in MOKOSH_AUTH_JWT_PRIVATE_KEY_PATH / MOKOSH_AUTH_JWT_PUBLIC_KEYS_DIR before first start (PMS-289 made a missing key set fatal), and the planned removal of mechanism 2 once PMS-295 lands. #PMS-291
docs(auth): clarify SSO startup log + record PMS-291 posture decision
All checks were successful
Create release / Create release from merged PR (pull_request) Has been skipped
Details
E2E / Playwright against staging (pull_request) Successful in 45s
Details
Check / fmt + clippy + compile + tests (pull_request) Successful in 4m50s
Details
6f4aaf67e9 
Two PMS-291 ACs in one PR (docs + log only, no behaviour change):

1. The SsoSetup::NotConfigured WARN no longer implies the server fell back to legacy auth. The earlier "the server will run with legacy auth only" was misleading: it suggested mechanism 3 (HS256 cookie) was now the only path, when in fact the bunyip-as-OP Resource-Server path (mechanism 1, OIDC_ISSUER + OIDC_AUDIENCE) is the one the SPA + E2E actually use and is unaffected by mokosh-auth not mounting. The new wording names both surviving paths and explains that only mokosh's own /oauth2/* endpoints are unavailable.

2. CLAUDE.md "Auth: two systems coexist" rewritten as "Auth: three independent mechanisms" so the bunyip-RS path is documented alongside mokosh-auth and the legacy HS256 cookie path. Adds the PMS-291 posture decision (B-now / A-later per PMS-292 / PMS-295), the hard prerequisite that the Ed25519 keypair must already exist in MOKOSH_AUTH_JWT_PRIVATE_KEY_PATH / MOKOSH_AUTH_JWT_PUBLIC_KEYS_DIR before first start (PMS-289 made a missing key set fatal), and the planned removal of mechanism 2 once PMS-295 lands.

#PMS-291
YousifShkara deleted branch fix/pms-291-sso-log-and-docs 2026-06-14 04:53:35 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-server!229
No description provided.