LAST1.ID W6B Report — Cutover + Verification¶
Date: 2026-08-25 (Week 6 closed 2026-08-26)
Status: Week 6 COMPLETE (2026-08-26). Week 7 teardown COMPLETE — Tier 2 closed. See LAST1_ID_MIGRATION_PLAN.md closeout summary.
Executive summary¶
Coordinated cutover to https://auth.last1.id is complete. Synthetic partner OIDC E2E passes end-to-end. LastVet API and provider portal both point at the new issuer. iOS rebuild remains deferred post-soak per prior approval.
Ryan action: Browser check on https://auth.last1.id (health, optional Google OAuth, provider portal Last1 ID sign-in).
W6B-3 phased deployment¶
| Phase | Target | Status | Notes |
|---|---|---|---|
| 1 | Sovereign issuer → https://auth.last1.id |
Complete | BWS issuer/site URLs updated; Kong OIDC routes added; last1id-app on docker network |
| 2 | LastVet API LAST1_ID_API_BASE |
Complete | R940 prod (192.168.1.90), not AWS ECS: https://auth.last1.id |
| 3 | Provider portal rebuild + deploy | Complete | NEXT_PUBLIC_LAST1_ID_ISSUER=https://auth.last1.id; CF Pages production deploy |
| 4 | Synthetic OIDC E2E | Complete | week6b-oidc-e2e.sh ALL PASS |
| 5 | Ryan browser check | Complete (PASS) | Health, OIDC discovery, real Google OAuth (ryan@last1.enterprises, hd claim); provider portal separate |
Issues encountered and fixes¶
1. Kong did not expose partner OIDC publicly (404)¶
Symptom: /.well-known/openid-configuration returned 404 via tunnel.
Fix: Added Kong routes in setup-auth-stack.sh for /.well-known, /oauth, /api/oauth → http://last1id-app:5000.
2. last1id-app network isolation¶
Symptom: Kong upstream could not reach app on --network host.
Fix: Recreated last1id-app on auth-last1id_default with -p 127.0.0.1:5000:5000.
3. Authorize approve returned 401 Unauthorized¶
Symptom: POST /api/oauth/authorize/approve failed; app logs showed ECONNREFUSED 127.0.0.1:8443.
Root cause: After docker network move, SUPABASE_URL=https://127.0.0.1:8443 (Caddy on host) was unreachable from container.
Fix: BWS LAST1_ID_R940_PROD_SUPABASE_TLS_URL → https://auth.last1.id (public HTTPS via tunnel/Kong; satisfies app production HTTPS validation).
W6B-4 verification (automated)¶
=== W6B OIDC E2E (https://auth.last1.id) ===
PASS discovery issuer=https://auth.last1.id
PASS JWKS at https://auth.last1.id/.well-known/jwks.json
PASS signup (synthetic user)
PASS authorize approve (PKCE S256)
PASS token exchange
PASS id_token signature + iss claim (iss=https://auth.last1.id)
PASS userinfo round-trip
=== W6B OIDC E2E: ALL PASS ===
Public endpoints verified:
- https://auth.last1.id/auth/v1/health — GoTrue v2.196.0
- https://auth.last1.id/.well-known/openid-configuration — issuer https://auth.last1.id
LastVet prod env (/etc/lastvet-api/lastvet-api-prod.env):
- LAST1_ID_API_BASE="https://auth.last1.id"
Provider portal: Production CF Pages deploy aff08084 (branch main); build embeds issuer:"https://auth.last1.id".
Not changed (per plan)¶
- Railway / hosted Supabase — unchanged, restorable fallback
- GCP OAuth old client — not disabled
- iOS — still hardcoded
https://last1.id; rebuild deferred post-soak - Railway teardown — Week 7, after soak + explicit Ryan OK
W6C soak (started 2026-08-25)¶
Window: 24–48 hours
Script: scripts/last1-id/week6c-soak.sh (health + synthetic OIDC + pg_up scrape)
Monitor: W6B-1 alerts (Postgres down, Kong 5xx), Slack/email via Alertmanager
24h soak report (2026-08-26 ~12:47 PM PDT)¶
| Metric | Result |
|---|---|
| Window | 2026-08-25 19:47 UTC → 2026-08-26 19:47 UTC (clean anchor) |
| Automated probes | 99/100 ok (1 pre-fix FAIL at 19:43 UTC, before SUPABASE_URL fix) |
| Post-cutover probes | 99/99 ok (every 30 min) |
| Live health (T+24h) | GoTrue v2.196.0 |
| Live OIDC E2E (T+24h) | ALL PASS |
| Alert fires | None reported |
| Known gap | pg_up=unknown from auth VM probe (exporter scrape timeout); observability VM unaffected |
Gate: No P1 auth failures in 24h window. Minimum 24h soak met. Ryan closed Week 6 at 24h (2026-08-26); 48h mark skipped per founder call.
Week 6 closure (2026-08-26)¶
Approved by Ryan: Close Tier 2 Week 6 at 24h soak. Production auth + partner OIDC on https://auth.last1.id is the new primary.
Done¶
- Sovereign stack cutover (GoTrue, Kong, last1id-app, MinIO, tunnel DNS)
- LastVet API
LAST1_ID_API_BASE=https://auth.last1.id - Provider portal issuer
https://auth.last1.id - Ryan browser check (health, OIDC discovery, real Google OAuth)
- 24h automated soak: 99/99 post-cutover probes green
Deferred (post–Tier 2)¶
| Item | Status |
|---|---|
iOS issuer → auth.last1.id |
Queue rebuild when ready |
my.last.vet Last1 ID sign-in |
New scope; Ryan decision pending |
| Provider portal staging issuer cleanup | Small task |
Week 7 (2026-08-26): Railway, hosted Supabase, legacy GCP OAuth deleted. See W7-1–W7-7 reports.
Ryan browser check (2026-08-25 — PASS)¶
/auth/v1/health— GoTrue v2.196.0 (matches Gate C upgrade)- OIDC discovery — all endpoints on
auth.last1.id; JWKS healthy (Railway 500 not inherited) - Google OAuth — full flow with real Google auth; access token + session for
ryan@last1.enterprises;hdclaim present provider.last.vet— Ryan to verify separately if not already done
W6C soak reporting schedule¶
Soak anchor: 2026-08-25 ~12:47 PM PDT (first clean automated probe).
| Mark | Target (PDT) | Target (UTC) |
|---|---|---|
| ~12h | Aug 26 ~12:47 AM | Aug 26 07:47 |
| ~24h | Aug 26 ~12:47 PM | Aug 26 19:47 |
| ~48h (gate) | Aug 27 ~12:47 PM | Aug 27 19:47 |
Report health + synthetic OIDC probe summary at 12h and 24h. Any status=FAIL, alert fire, or auth regression → immediate report.
Rollback (if needed)¶
- Revert DNS
auth.last1.id(or point tunnel elsewhere) - Revert BWS issuer URLs to prior values
- Restore LastVet
LAST1_ID_API_BASEand redeploy provider portal with prior issuer - Railway/Supabase remain available as fallback