feat(infra): put a door in front of UAT so the Tracker can run the only way it runs - #640
Merged
Merged
Conversation
…ly way it runs The Tracker was set to Staging here on the reasoning that DevBypass is for laptops. Correct in principle, unusable in fact: `AuthenticationExtensions.cs:66` refuses to register DevBypass outside Development and demands a UMS authority instead, and no identity provider is deployed. Measured on the live environment: `/api/v1/health` 200, `/api/v1/initiatives` 401 — every screen an empty error card while the health check stayed green. So the choice the Tracker offers today is Development or nothing, and Development authenticates every request as a full-permission administrator. Rather than ship that to a host anyone can reach, the guard moves to the perimeter: tracker-web's router carries an HTTP basic-auth middleware, so a request without the credential is refused by the proxy and never reaches a service that would trust it. The two halves are one mechanism. Development alone is an open admin console on the internet; the middleware alone protects a service that would have rejected the request anyway. Removing either one silently removes the protection, which is why the compose comment says so at both sites. The middleware is referenced as `uat-basicauth@file` and DEFINED in the proxy's dynamic configuration, deliberately not here. A bcrypt hash committed to a public repository is a hash published to everyone who can read it, and this repository is public. Reverts to Staging when Tracker ADR T-053 (consume UMS identity) lands. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem this fixes
UAT looked healthy and could not be used. Measured on the live environment:
/api/v1/health/api/v1/initiatives/api/v1/sdlc/executionsEvery screen rendered an error card while the health check stayed green.
Cause
This file set
ASPNETCORE_ENVIRONMENT: Staging, on the reasoning that DevBypass belongs on a laptop. That reasoning is right and the outcome is unusable, becauseAuthenticationExtensions.cs:66is explicit:No identity provider is deployed. So outside Development the Tracker authenticates nobody, and the UAT client sees a wall of errors.
The change, which is two halves of one mechanism
Development, because it is the only mode the Tracker leaves available without UMS.Neither half is sufficient alone:
Developmentwithout the door is an open admin console on the public internet.Developmentprotects a service that was going to reject the request anyway.Remove either and the protection disappears silently — nothing errors, the environment still looks fine. The compose comments say this at both sites for that reason.
Why the hash is not in this file
The middleware is referenced as
uat-basicauth@fileand defined in the proxy's dynamic configuration. This repository is public; a bcrypt hash committed here is a hash handed to everyone who can read it.Lifetime
This is scaffolding with a stated end. When Tracker ADR T-053 (consume UMS identity) lands, this returns to
Stagingand the middleware can be dropped.🤖 Generated with Claude Code