SPRINT-7 T5-A Report — GoTrue Provider Migration (last1app-db)¶
Date: 2026-08-30 (updated 2026-08-30 23:10 UTC)
Status: T5-A CLOSED — all GoTrue providers PASS on sovereign last1app-db
Target: VM 103 last1app-db / sovereign GoTrue (192.168.1.103:8000, public staging https://last1app-db.last1.enterprises)
Prior: SPRINT7_T4-R_REPORT.md (provider sweep findings)
Verdict¶
T5-A CLOSED — STOP before T5-B public exposure¶
| Provider | Sovereign status | Blocker |
|---|---|---|
| PASS (T4-R) | None | |
| Phone OTP (Twilio) | PASS-on-delivery | None — provider wired; no further OTP sends |
| Apple SIWA | PASS (Path B) | None — key 454MM9MC64, Services ID auth.last1.radiocheck |
| Email SMTP (GoTrue) | PASS | Resend wired; §5c test delivered |
Do not expose api.last1.app (T5-B) until RLS remediation PASS (separate BLOCK).
Executive summary¶
| Workstream | Result |
|---|---|
| Phone OTP → GoTrue Twilio | PASS-on-delivery |
| Apple SIWA | PASS — Path B (454MM9MC64 + BWS .p8) |
| Google OAuth | UNCHANGED PASS from T4-R |
| Email SMTP → Resend | PASS |
Scripts added/updated:
| Script | Purpose |
|---|---|
configure-last1app-gotrue-twilio.sh |
Enable GoTrue Twilio SMS |
configure-last1app-gotrue-apple.sh |
Path B: Apple from BWS .p8 + redirect URI |
push-last1app-apple-bws.py |
Push Apple secrets to BWS (PEM-safe create) |
import-last1app-apple-p8.sh |
BWS push + sovereign configure one-shot |
fetch-last1app-apple-from-hosted.py |
Pull hosted Apple config (curl UA fix for CF 1010) |
configure-last1app-gotrue-apple-from-hosted.sh |
Path A: fails fast if secret is digest |
configure-last1app-gotrue-resend-smtp.sh |
Wire GoTrue SMTP to Resend |
test-last1app-gotrue-smtp.sh |
§5c recover email to Ryan only |
push-last1-platform-supabase-pat.sh |
One-time store task-scoped Management API PAT |
test-last1app-gotrue-phone-otp.sh |
Ryan-only OTP send (§5c; closed) |
1. Phone OTP → GoTrue Twilio¶
Verdict: PASS-on-delivery (unchanged from prior report). Twilio wired; one §5c SMS to +18186932921 delivered; no further OTP sends.
2. Apple SIWA (RadioCheck — not Onset)¶
Required identity¶
| Field | Value |
|---|---|
| Apple Services ID | auth.last1.radiocheck |
| iOS bundle id (native id_token aud) | com.last1.radiocheck |
| NOT Onset key | TU6S85XABQ is VM 119 only |
Path A attempt (2026-08-30, PAT in BWS)¶
| Step | Result |
|---|---|
Load SUPABASE_ACCESS_TOKEN from last1-platform BWS |
PASS |
GET /projects/tcthzakppndkykatoefx/config/auth (curl + User-Agent: last1-migration/1.0) |
PASS (urllib without UA got CF 1010 from VM) |
external_apple_enabled |
True |
external_apple_client_id |
auth.last1.radiocheck |
external_apple_secret |
64-char hex digest (b916f7ab…), not a JWT |
Same redaction on external_google_secret |
64-char digest (Google on sovereign uses BWS full secret from T4-R manual push, not API) |
configure-last1app-gotrue-apple-from-hosted.sh |
FAIL (expected) — cannot copy signing material |
Conclusion: Supabase Management API does not return copyable OAuth secrets for self-hosted GoTrue. Path A works for client id confirmation only, not secret migration.
Unblock options (Ryan picks one)¶
| Path | Ryan action | Agent next step |
|---|---|---|
| B (recommended) | Add to last1-radiocheck BWS: LAST1APP_DB_PROD_APPLE_TEAM_ID, LAST1APP_DB_PROD_APPLE_KEY_ID, LAST1APP_DB_PROD_APPLE_PRIVATE_KEY (.p8), optional LAST1APP_DB_PROD_APPLE_SERVICES_ID=auth.last1.radiocheck |
Run configure-last1app-gotrue-apple.sh on VM 103 |
| A′ (manual JWT) | Copy full client secret JWT from hosted Dashboard → Authentication → Apple (edit provider → secret field) into BWS as LAST1APP_DB_PROD_APPLE_OAUTH_JWT |
Patch configure script to load JWT from BWS (or one-time env export) |
Pass criteria (unchanged): auth/v1/settings → apple: true; authorize → 302 with client_id=auth.last1.radiocheck; key id ≠ TU6S85XABQ.
PAT: Revoked (Ryan confirmed). Path A closed — Management API returns digest only.
Path B (2026-08-30 23:10 UTC) — PASS¶
| Step | Result |
|---|---|
Ryan placed AuthKey_454MM9MC64.p8 on agent |
PASS |
push-last1app-apple-bws.py → BWS LAST1APP_DB_PROD_APPLE_* |
PASS (create uses KEY -- VALUE PROJECT_ID for PEM) |
configure-last1app-gotrue-apple.sh on VM 103 |
PASS |
auth/v1/settings → apple: true |
PASS |
GET /auth/v1/authorize?provider=apple → 302 |
PASS |
Authorize client_id |
auth.last1.radiocheck (Services ID first in comma list) |
apple_key_id |
454MM9MC64 (≠ Onset TU6S85XABQ) |
GOTRUE_EXTERNAL_APPLE_REDIRECT_URI |
https://last1app-db.last1.enterprises/auth/v1/callback |
Note: GOTRUE_EXTERNAL_APPLE_CLIENT_ID order is auth.last1.radiocheck,com.last1.radiocheck — Services ID first for web authorize; bundle id retained for native id_token aud validation.
3. Google OAuth (unchanged — T4-R)¶
PASS — no T5-A changes.
4. GoTrue SMTP → Resend¶
Verdict: PASS (2026-08-30 22:32 UTC)
Configuration applied (VM 103)¶
| Setting | Value |
|---|---|
SMTP_HOST |
smtp.resend.com |
SMTP_PORT |
465 |
SMTP_USER |
resend |
SMTP_PASS |
BWS LAST1APP_DB_PROD_RESEND_API_KEY |
SMTP_ADMIN_EMAIL |
noreply@last1.enterprises (verified Resend domain for last1.app/RadioCheck stack) |
SMTP_SENDER_NAME |
RadioCheck |
| Auth container | docker compose up -d --force-recreate auth |
BWS hygiene: SMTP_ADMIN_EMAIL in BWS was stored as oreply@last1.enterprises (missing leading n). Agent patched .env to noreply@last1.enterprises for tonight. Ryan: fix BWS value before next stack rebuild.
§5c test (Ryan only)¶
| Step | Result |
|---|---|
POST /auth/v1/recover → ryan@last1.enterprises |
HTTP 200 |
| GoTrue audit | user_recovery_requested, actor ryan@last1.enterprises |
Resend API (GET /emails) |
delivered — "RadioCheck" <noreply@last1.enterprises>, subject Reset Your Password |
No further test emails.
5. SendGrid inventory (migration seed)¶
Deliverable: SENDGRID_TO_RESEND_INVENTORY.md
- 13-key product matrix (Ryan list)
- 8 API keys found in BWS; 5 marketing
-webkeys expected in Cloudflare Pages env - RealOutcomes duplicate key flagged for migration-time audit (BWS shows one key today)
- Linked from POST_MIGRATION_ROADMAP.md §1
6. Provider status matrix¶
| Provider | Hosted | Sovereign | Credential source |
|---|---|---|---|
| enabled | enabled | BWS LAST1APP_DB_PROD_GOOGLE_OAUTH_* |
|
| Phone | Twilio | PASS-on-delivery | BWS Twilio |
| Apple | enabled, auth.last1.radiocheck |
enabled PASS | BWS LAST1APP_DB_PROD_APPLE_* key 454MM9MC64 |
| Email (GoTrue) | SendGrid (hosted) | Resend PASS | BWS LAST1APP_DB_PROD_RESEND_API_KEY + noreply@last1.enterprises |
7. Ryan actions (T5-A closed)¶
- ~~Phone OTP~~ — PASS-on-delivery (closed).
- ~~PAT~~ — revoked (Ryan confirmed).
- ~~Resend SMTP~~ — PASS (closed).
- ~~Apple Path B~~ — PASS (closed 2026-08-30).
- ~~Fix BWS
SMTP_ADMIN_EMAILtypo~~ — fixed in BWS. - Next: T5-B RLS remediation only when Ryan authorizes (current Phase 1 BLOCK).
STOP¶
T5-A CLOSED. Do not start T5-B public exposure until RLS Phase 1 remediation PASS.
Next gate: T5-B Phase 1 RLS security pass — current verdict BLOCK (separate workstream).