SPRINT-2 Gate B Report — Code Refactor (S2-B)

Status: STOP — Ryan code diff review required
Date: 2026-08-28
Branch: sprint-2-last1id-auth (RealOutcomes repo)
Not merged to main

---

Summary

Replaces Supabase GoTrue client auth with Last1 ID OIDC (PKCE + server token exchange + JWKS bearer validation). Pattern matches LastVet provider portal.

No deploy to VM 116 until Gate B approved. GoTrue on VM 117 remains live for rollback.

---

Files changed (12 + package lock)

File	Change
package.json	+@last1id/sdk, +jose
client/src/lib/last1Auth.ts	New — PKCE authorize flow
client/src/lib/session.ts	New — sessionStorage tokens
client/src/pages/login.tsx	Last1 ID sign-in only
client/src/pages/auth/callback.tsx	OAuth code → POST /api/auth/last1/callback
client/src/hooks/use-auth.ts	Session bearer
client/src/lib/queryClient.ts	Session bearer headers
client/src/lib/supabase.ts	Gutted (auth removed)
server/lib/last1IdOAuth.ts	New — token exchange + JWKS (from last.vet-api)
server/auth.ts	JWKS validation, POST /api/auth/last1/callback
lastvet-gates/scripts/realoutcomes/render-realoutcomes-env-app.sh	VITE_* mirror for client build

---

New API route

POST /api/auth/last1/callback

Body: { code, codeVerifier, expectedNonce }

Response: { accessToken, refreshToken, expiresIn, user }

Server upserts public.users with id = id_token.sub (last1.id identity_id).

---

Env vars (BWS → VM 116, Gate C)

Runtime	Purpose
LAST1_ID_ISSUER	https://auth.last1.id
LAST1_OAUTH_CLIENT_ID	realoutcomes
LAST1_OAUTH_CLIENT_SECRET	Token exchange (server only)
LAST1_OAUTH_REDIRECT_URI	Must match authorize + app_clients
VITE_LAST1_ID_ISSUER	Client build (mirrored by render script)
VITE_LAST1_OAUTH_CLIENT_ID	Client build
VITE_LAST1_OAUTH_REDIRECT_URI	Client build

---

Verification run (local)

cd RealOutcomes && npm install && npm run check

Result: tsc pass (2026-08-28).

---

Ryan Gate B checklist

• [ ] Review PR diff (login/callback/session/server auth)
• [ ] Confirm Supabase password/OTP/Google removal is acceptable for Phase 1
• [ ] Confirm env var naming matches BWS render script
• [ ] Approve to proceed → Gate C (deploy VM 116, OAuth loop, GoTrue still running)

---

Blocked until Gate B approval

Gate	Work
C	Deploy branch to VM 116, end-to-end OAuth smoke
D	Mandatory pg_dump; FK remap ryan@last1.enterprises only; verify 2 real logins
E	Retire VM 117 GoTrue
F	SPRINT-2 closeout → SPRINT-3 (realoutcomes-edge)

Gate D note: rydaunicorn@gmail.com already deleted. FK remap affects ryan@last1.enterprises only (d1034389… → 52ce85f9…).