Repository navigation
feat(web): own tenant BFF sessions and close browser admission - #36
Merged
Merged
Conversation
Record both fresh quota reviews, current Release and PostgreSQL proofs, and the complete frontend source inventory correction. Freeze the source for renewed exact-head CI; historical results remain source-specific.
Record the identical squash-merge tree and complete final-source A/B qualification. Reconcile mutable status carriers while preserving dated delivery receipts and keeping P02b-5 authentication gates open. ADR: 0047, 0063
Connect the published squash merge to the continuing development branch so subsequent pull requests start from main. Preserve the reviewed merge content and the documentation closeout without changing the file tree.
Verify the authentication entry contract before exposing validated claims while authorization remains staged. Record the bounded audit and read-mode instruments, shared ingress costs and five reviewable development steps for maintainer approval before runtime changes. ADR: 0064, 0036, 0040
Keep the reviewed proposal and current entry evidence separate from runtime delivery. Close both independent decision review rounds, reconcile mutable phase pointers and retain the explicit maintainer acceptance boundary. ADR: 0064, 0036, 0040
Make absent-credential masking, host-backed read admission and rejection attribution explicit before activation. Close JOSE and vendor diagnostic boundaries, disclose the full read-mode scope extension and preserve prior review receipts with dated finding dispositions rather than rewriting them. ADR: 0064, 0036, 0040, 0052
Retain independent review evidence without treating it as acceptance. Make real-identifier checks explicit at the host-backed read boundary so an initialized wrapper cannot be mistaken for a valid tenant identity. ADR: 0064, 0036, 0040, 0052
Record the second independent revision round and final document checks without treating reviewer approval as maintainer acceptance. Keep the original receipts and runtime boundary explicit before renewed approval. ADR: 0064, 0036, 0040, 0052
Record explicit maintainer acceptance before dependent runtime work. Disclose the bounded audit and exact read-mode changes in each affected ADR, correct row-10 staging through adjacent errata, and register the five proof obligations without claiming implementation evidence. ADR: 0064, 0036, 0040, 0052
Validate signed tenant credentials against the accepted closed profile and bound metadata retrieval before activating the HTTP authentication surface. Keep raw vendor failures out of enabled sinks while preserving closed application outcomes and unrelated diagnostics. ADR: 0064, 0036, 0032
Constrain native HTTP and DNS metric dimensions because request-local trace suppression does not prevent destination names reaching OTLP. Preserve duration and status signals, and prove the boundary with real retrieval, an unprojected control and a distinct hostname canary. ADR: 0064, 0032
Record independent validation of the native metric privacy correction and keep the primary status carriers aligned before starting the real read-only application subject. ADR: 0064
Expose only the caller's validated scope and the existing public site projection through an independently guarded application request. Select its physical read-only mode by one immutable exact-type declaration and share the existing transaction owner across API and Seeder composition. Prove actual app-role isolation, lifecycle visibility, audit Off behavior and SQL/EF write refusal before routing the request over HTTP. ADR: 0064, 0040, 0052, 0036
Record both independent Step 2 first-round checks and reconcile the read-only standard with the implemented query before HTTP activation. ADR: 0064, 0040, 0052
Record independent transaction, isolation and composition verification before starting attributed reconciliation and subject admission. ADR: 0064
Carry validated identity through reconciliation without inventing audit tenants, and bound authenticated rejection work before recording. Preserve anonymous admission and keep production HTTP activation in the next step. ADR: 0064, 0036, 0033, 0044
Record independent checks of quota lifetime, attributed refusal and actual app-role audit behavior before the second review round. ADR: 0064
Apply the identifier emission rule to both rejection log paths and pin the actual subject quota window independently. Close both Step 3 reviews with verified corrections and a planted default-window control. ADR: 0064, 0023
Keep the current packet summary within the documentation prose convention. ADR: 0064
Bind strict bearer validation, host reconciliation and subject admission to one independently guarded read. Keep anonymous transport credential-free and qualify production routing, durable rejection attribution and generated public/authenticated contracts before widening the HTTP surface. ADR: 0064, 0036, 0040, 0052 Module: Tenancy
The actual HTTP boundary rejects oversized GET bodies before authentication, but generated clients could not see that response. Require 413 in the served contract and negative controls while preserving the existing runtime outcome. ADR: 0064
Record independent rechecks of the complete active boundary and its corrected contract before progressing to final production enforcement and qualification. ADR: 0064
Keep the activated authentication boundary dependent on its typed, validated identity and explicit production consumers. Prove missing, forged and mutable subjects fail the same complete census. Reconcile carrier contracts and catalogue owners without claiming pending CI. Make terminal-plan seed maintenance explicit so bitmap EXPLAIN counts measure live backlog rather than obsolete MVCC index entries. ADR: 0064
Reject role metadata through its interface and positional identity extraction through generated deconstruction. Compiled negative controls reproduce each review gap before the detector correction. Reconcile the older job manifest's exact controller inventory with the approved AccountSite read and exercise its extra-action refusal. Align catalogue derivations and startup guidance with the active boundary. ADR: 0064
Keep record formatting and alternate token APIs from bypassing the typed identity census. Bound acquisition and forwarding to the actual owners, and resolve authorization metadata through inheritance and interfaces. Compiled negative controls reproduce all three review gaps before the corrections; independent original probes confirm closure. Reconcile the remaining scalar-scope and membership reachability documentation. ADR: 0064
Record all five completed steps, both independent review rounds and verified corrections while separating failed/as-of receipts from final PR-head qualification. Keep realm issuance, browser sessions and phase exit with their first consumers; start no next packet. ADR: 0064
Keep the live PR-head CI receipt discoverable from the local delivery record without treating an unmerged implementation as a merged packet. ADR: 0064
Accept the reviewed target-tenant audit allowance before dependent code. Disclose the loss of durable actor coverage and outbound destination metrics, preserve older decisions, and reconcile the proof owners. ADR: 0036, 0064, 0065
Bind authentication and host authority to validated inputs, enforce the reviewed audit allowance, and strengthen the production censuses with load-bearing controls. Keep public transport and API configuration confined and reconcile the served OpenAPI and generated SDK contracts. ADR: 0036, 0040, 0052, 0064, 0065 Module: Tenancy, Kernel
An API 401 cannot distinguish invalid from undecidable credentials. Preserve ordinary-read ownership without idle touch while withholding checked content; keep callback and refreshed revision publication fail closed. ADR: 0064, 0070, 0071
Keep the fixed configuration export from delegating to an uninspected local wrapper while preserving the clean pinned Next integration. ADR: 0070
Keep safe recovery available while withholding unverified content. Exercise actual child-output and cookie-header observations, and retain current localized fixture views without claiming a full provider browser journey. ADR: 0027, 0070 I18n: en/tr auth catalogues updated
Make original cookie revocation, opposite-tenant refusal and closed successful causal observations visible through their actual owners. Plant isolated CI violations while preserving existing budgets and production job semantics. ADR: 0047, 0063, 0070, 0071
Keep current architecture, standards and future acceptance owners aligned with the delivered native boundary. Carry the closed privacy stage through both proof readers without changing authority, cleanup or deployment support. ADR: 0069, 0070, 0071
Preserve the native host rule while excluding unverified browser selectors, and record the first correction review and source-bound qualification gates. ADR: 0063, 0070, 0071
Use fresh fixture-owned issuance time instead of assuming an optional response header. Keep the real browser negative aligned with HTML while independently preserving publication, audit and reader-isolation checks. ADR: 0070, 0071
Replace a vacuous ownership comparison and isolate cancellation, body failure and Problem Details mapping in the authenticated wrapper without duplicating the shared public response policy or changing runtime behavior. ADR: 0064, 0070, 0071
Separate the verified wrapper coverage gap from an unreproduced signal claim, and retain the complete current frontend census without overstating scope. ADR: 0064, 0069, 0070, 0071
Close the completed local review gates while keeping exact-source hosted qualification, durable receipt and maintainer merge as explicit remaining work. ADR: 0063, 0069, 0070, 0071
Keep the original timeout and ownership failure visible while retaining bounded pre-stop progress facts for the unexplained hosted failure. ADR: 0047, 0063, 0069
Prevent the finite diagnostic control from shrinking with its production allowlist and preserve the failed qualification's exact evidence scope. ADR: 0063, 0069
Distinguish launch phases and retain branded readiness failures without changing browser execution, deadlines or actual cleanup requirements. ADR: 0063, 0069, 0070
Keep the readiness diagnostic faithful for failed spawns as well as observed exits and preserve the completed first-round review evidence. ADR: 0063, 0069, 0070
Use the qualified real-timer pacing owner to exclude an unrelated legal pre-ACK refusal while retaining original deadlines, runtime policy and all causal provider, cleanup and durable-state assertions. ADR: 0047, 0063, 0069
Bind the completed reviews and independently verified A/B evidence to its exact implementation source while keeping the closeout documentation-only. ADR: 0063, 0069, 0070, 0071
cemililik
marked this pull request as ready for review
October 24, 2026 16:08
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
cemililik
marked this pull request as draft
October 24, 2026 17:44
Isolate security controls from unrelated refusals and keep recovery usable without granting failed checks authority. Bind native credential flows to the fixed port, bound diagnostic child output and preserve source-bound qualification and explicit maintainer acceptance evidence. ADR: 0009, 0047, 0063, 0069, 0070, 0071 I18n: auth.session.unavailable_title, auth.session.unavailable
Bind the independent source-review conclusions and their executed checks to the committed correction without presenting local results as hosted qualification. ADR: 0069, 0070, 0071
Preserve the second fresh review scope and independently executed checks, then freeze the corrected source for complete hosted qualification. ADR: 0063, 0069, 0070, 0071
A valid opaque cookie can begin with a dash. Keep it positional after the Node option terminator and force that boundary in both output observers so the controls reach the intended late-cookie assertion. ADR: 0063, 0069, 0070
Keep the exact narrow review and independent argv/scanner checks distinct from the failed hosted assignment and pending final qualification. ADR: 0063, 0069, 0070
Record the second independent observer review and preserve failed-source limits before beginning complete qualification of the corrected source. ADR: 0063, 0069, 0070
Bind complete same-source A/B and retained independent evidence to the reviewed implementation while keeping this closeout documentation-only. ADR: 0063, 0069, 0070, 0071
cemililik
marked this pull request as ready for review
October 24, 2026 19:30
cemililik
added a commit
that referenced
this pull request
Oct 24, 2026
Record PR #36's verified merge and identical tested source tree. Close P02b-7 while keeping P02b-8's decisions, erasure inventory and phase exit enforcement explicitly pending. ADR: 0069, 0070, 0071
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tests
Local lint/typecheck/production build and the complete 2,376-case frontend guard pass. Additional checks pass 395 realm Node controls, 87 native-owner controls, 30 result/aggregate controls and 15 selected real integrations. The actual warm Keycloak → BFF → application-role API chain passes on both hosts. A separate controlled-grant/API Chromium proof covers cookies, keyboard, extension and logout/history with a live counter; it is not a full real-provider browser journey.
Implementation/review source
0bde36f0passes complete A/1 and B/2 in run 40120289765: each has 27/27 successful jobs, seven required contexts, 5,931 .NET and 2,376 frontend cases, zero skips, exact ownership and natural cleanup. Independent recomputation confirms different co-membership and matching manifest/plan/captured toolchains. The source-bound qualification record contains exact source/merge/digests and both fresh review rounds for runtime and observer corrections.Documentation-only closeout
6b6f0629passes its complete current-head assignment in run 40124028474: 27/27 jobs and all seven required contexts. Its only diff from the A/B source is the two roadmap documents. Retained-evidence audit confirms unchanged manifest, plan, captured toolchains and case population, all 20 natural producer cleanups and nine demo navigations/27 Lighthouse reports. Failed run 40118767190 remains failed: a valid leading-dash observer canary reproduces child exit 9, corrected with Node's option terminator. The original random CI value was not retained; its recovery is not claimed. Earlier failures and explicit browser/diagnostic witness limits remain recorded.Risk
Tenant/host admission and credential custody follow ADR-0064/0070/0071; no business permission or general API proxy is introduced. Sessions are volatile and support one native web process; restart signs users out. Shared Keycloak SSO logout can affect other signed-in hosts. A genuine ordinary API 401 can retain local credentials until an existing revocation/deadline boundary; it never grants that failed response access. Masked 403/404 retain their conservative revocation behavior. Phase 06 owns the full real-browser OIDC/browser matrix; Phase 11 owns production/distributed qualification.
Migration / Rollback
No database migration. Even with sign-in disabled, existing environment sources must be regular, nonsymlink, finite and well-formed files; a regular 0644 file remains valid in public-only mode. Enabled mode additionally requires owner-private single-link files. Browser sign-in remains opt-in; follow native web setup for agreeing private configuration sources and the confidential client secret. Disabling the opt-in and restarting returns to public-only operation and loses volatile sessions. Development realm event-policy writes are separately read back and preserved; disabling web sign-in does not roll them back.
Related
Phase 02b, ADR-0064, ADR-0070, ADR-0071.
Current scaffold views — owned fixture, not a live tenant
Turkish Studio view
Prepared with Codex.