Unified authentication: a single sign-in surface for portal and admin

apps/web/e2e/scripts/refresh-admin-session.ts

@@ -0,0 +1,85 @@
+/**
+ * CLI: refresh e2e/.auth/admin.json with a current session token for
+ * demo@example.com. Uses the most recent valid session row directly from the
+ * DB and constructs the signed cookie (HMAC-SHA256(token, SECRET_KEY)) so the
+ * stored auth-state works without navigating through the magic-link flow.
+ *
+ * Run this instead of global-setup when the admin session has expired and
+ * magic-link sign-in is blocked by twoFactor.required (or any other 2FA gate).
+ *
+ * Usage: bun refresh-admin-session.ts
+ */
+import postgres from 'postgres'
+import { createHmac } from 'crypto'
+import { writeFileSync } from 'fs'
+import { resolve } from 'path'
+
+const connectionString = process.env.DATABASE_URL
+if (!connectionString) {
+  console.error('DATABASE_URL environment variable is required')
+  process.exit(1)
+}
+const secret = process.env.SECRET_KEY
+if (!secret) {
+  console.error('SECRET_KEY environment variable is required')
+  process.exit(1)
+}
+
+const sql = postgres(connectionString)
+
+try {
+  // Get the most recent valid session for the admin user.
+  const rows = await sql`
+    SELECT s.token, s.expires_at
+    FROM session s
+    JOIN "user" u ON u.id = s.user_id
+    WHERE u.email = 'demo@example.com'
+      AND s.expires_at > NOW()
+    ORDER BY s.created_at DESC
+    LIMIT 1
+  `
+
+  if (rows.length === 0) {
+    console.error(
+      'No valid session found for demo@example.com. ' +
+        'Run the global-setup project (bun run test:e2e --project=setup) first.'
+    )
+    await sql.end()
+    process.exit(1)
+  }
+
+  const token = rows[0].token as string
+  const expiresAt = rows[0].expires_at as Date
+
+  // Reproduce better-auth's setSignedCookie format: token.HMAC-SHA256(token, secret)
+  const sig = createHmac('sha256', secret).update(token).digest('base64')
+  const cookieValue = `${token}.${sig}`
+
+  // Write the storageState JSON that Playwright understands.
+  const state = {
+    cookies: [
+      {
+        name: '__Secure-better-auth.session_token',
+        value: cookieValue,
+        domain: 'acme.localhost',
+        path: '/',
+        expires: expiresAt.getTime() / 1000,
+        httpOnly: true,
+        secure: true,
+        sameSite: 'Lax' as const,
+      },
+    ],
+    origins: [],
+  }
+
+  const outPath = resolve(import.meta.dirname, '../.auth/admin.json')
+  writeFileSync(outPath, JSON.stringify(state, null, 2))
+  console.log(
+    JSON.stringify({ action: 'refresh-admin-session', token: token.slice(0, 8) + '…', expiresAt })
+  )
+  await sql.end()
+} catch (err) {
+  console.error(err instanceof Error ? err.message : String(err))
+  await sql.end()
+  process.exit(1)
+}

apps/web/e2e/scripts/seed-identity-provider.ts

@@ -0,0 +1,133 @@
+/**
+ * CLI: seed or remove an `identity_provider` row (+ its encrypted client
+ * credential and an optional verified domain) for the identity-providers e2e.
+ *
+ * settings.* columns are JSON text; the provider model lives in the
+ * `identity_provider`, `sso_verified_domain`, and `integration_platform_credentials`
+ * tables. We write raw SQL (same style as the other e2e scripts) and generate
+ * TypeIDs via `@quackback/ids` (the column default is a JS-level drizzle default
+ * that a raw insert wouldn't trigger).
+ *
+ * The client secret is encrypted with the SAME AES-256-GCM + HKDF scheme as the
+ * app's `encryptPlatformCredentials` (purpose `integration-platform-credentials`)
+ * and stored at integration_type `auth_<registrationId>`, so the provider
+ * satisfies the runtime registration gate (enabled + creds + tier). The
+ * registration/routing/button gates only check that the credential ROW exists
+ * (no decrypt), so the secret never needs to round-trip — but encrypting it
+ * properly keeps the row indistinguishable from an app-written one.
+ *
+ * Usage:
+ *   bun seed-identity-provider.ts seed '<json>'
+ *   bun seed-identity-provider.ts remove <registrationId>
+ *
+ * seed JSON: {
+ *   registrationId, label, clientId,
+ *   discoveryUrl?, enabled?=true, showButton?=false, clientSecret?='e2e-secret',
+ *   domain?: { name, verified?=true, enforced?=false }
+ * }
+ *
+ * After mutating, the caller (access-helpers) drops the tenant-settings +
+ * configured-types Redis caches so the running dev server sees the change.
+ */
+import postgres from 'postgres'
+import { hkdfSync, randomBytes, createCipheriv, randomUUID } from 'crypto'
+import { generateId, toUuid } from '@quackback/ids'
+
+const action = (process.argv[2] || '').toLowerCase()
+if (action !== 'seed' && action !== 'remove') {
+  console.error("Usage: bun seed-identity-provider.ts <seed '<json>' | remove <registrationId>>")
+  process.exit(1)
+}
+
+const connectionString = process.env.DATABASE_URL
+if (!connectionString) {
+  console.error('DATABASE_URL environment variable is required')
+  process.exit(1)
+}
+
+/** Mirror of `encryptPlatformCredentials` (lib/server/integrations/encryption.ts):
+ *  HKDF-SHA256(SECRET_KEY, salt, info) -> AES-256-GCM, format iv.tag.ct (base64url). */
+function encryptPlatformCredentials(creds: Record<string, string>): string {
+  const secretKey = process.env.SECRET_KEY
+  if (!secretKey) throw new Error('SECRET_KEY environment variable is required')
+  const info = 'quackback:v1:integration-platform-credentials'
+  const key = Buffer.from(hkdfSync('sha256', secretKey, 'quackback-encryption-salt-v1', info, 32))
+  const iv = randomBytes(12)
+  const cipher = createCipheriv('aes-256-gcm', key, iv, { authTagLength: 16 })
+  const ct = Buffer.concat([cipher.update(JSON.stringify(creds), 'utf8'), cipher.final()])
+  const tag = cipher.getAuthTag()
+  return [iv.toString('base64url'), tag.toString('base64url'), ct.toString('base64url')].join('.')
+}
+
+interface SeedConfig {
+  registrationId: string
+  label: string
+  clientId: string
+  discoveryUrl?: string
+  enabled?: boolean
+  showButton?: boolean
+  clientSecret?: string
+  domain?: { name: string; verified?: boolean; enforced?: boolean }
+}
+
+const sql = postgres(connectionString)
+
+async function remove(registrationId: string): Promise<void> {
+  // Deleting the provider cascades its sso_verified_domain rows (FK on delete
+  // cascade); the credential has no FK, so drop it explicitly.
+  await sql`DELETE FROM identity_provider WHERE registration_id = ${registrationId}`
+  await sql`DELETE FROM integration_platform_credentials WHERE integration_type = ${`auth_${registrationId}`}`
+}
+
+async function seed(cfg: SeedConfig): Promise<void> {
+  // Idempotent: clear any prior row for this registrationId first.
+  await remove(cfg.registrationId)
+
+  const idpUuid = toUuid(generateId('identity_provider'))
+  await sql`
+    INSERT INTO identity_provider
+      (id, registration_id, label, client_id, discovery_url, enabled, auto_create_users, show_button, created_at)
+    VALUES
+      (${idpUuid}, ${cfg.registrationId}, ${cfg.label}, ${cfg.clientId}, ${cfg.discoveryUrl ?? null},
+       ${cfg.enabled ?? true}, true, ${cfg.showButton ?? false}, NOW())`
+
+  const credUuid = toUuid(generateId('platform_cred'))
+  const secrets = encryptPlatformCredentials({ clientSecret: cfg.clientSecret ?? 'e2e-secret' })
+  await sql`
+    INSERT INTO integration_platform_credentials (id, integration_type, secrets, created_at, updated_at)
+    VALUES (${credUuid}, ${`auth_${cfg.registrationId}`}, ${secrets}, NOW(), NOW())`
+
+  if (cfg.domain) {
+    const domUuid = toUuid(generateId('domain'))
+    const verifiedAt = cfg.domain.verified === false ? null : new Date()
+    await sql`
+      INSERT INTO sso_verified_domain
+        (id, name, verification_token, verified_at, enforced, provider_id, created_at)
+      VALUES
+        (${domUuid}, ${cfg.domain.name}, ${`e2e-${randomUUID()}`}, ${verifiedAt},
+         ${cfg.domain.enforced ?? false}, ${idpUuid}, NOW())`
+  }
+}
+
+try {
+  if (action === 'remove') {
+    const registrationId = process.argv[3]
+    if (!registrationId) throw new Error('remove requires a <registrationId>')
+    await remove(registrationId)
+    console.log(JSON.stringify({ action: 'remove', registrationId }))
+  } else {
+    const raw = process.argv[3]
+    if (!raw) throw new Error("seed requires a '<json>' config")
+    const cfg = JSON.parse(raw) as SeedConfig
+    if (!cfg.registrationId || !cfg.label || !cfg.clientId) {
+      throw new Error('seed config requires registrationId, label, clientId')
+    }
+    await seed(cfg)
+    console.log(JSON.stringify({ action: 'seed', registrationId: cfg.registrationId }))
+  }
+  await sql.end()
+} catch (err) {
+  console.error(err instanceof Error ? err.message : String(err))
+  await sql.end()
+  process.exit(1)
+}

apps/web/e2e/scripts/set-portal-auth-methods.ts

@@ -0,0 +1,77 @@
+/**
+ * CLI: disable or restore portal public auth methods in settings.portal_config.
+ * settings.portal_config is a JSON *text* column, so we read → patch → write.
+ * There is a single workspace settings row.
+ *
+ * When disabling: all stored oauth keys plus the known core methods (password,
+ * magicLink) are set to false — no portal sign-in method is presented to
+ * public users. The team break-glass form (TeamLoginForm) still appears for
+ * team-bound callbackUrls; that is the invariant this helper enables testing.
+ *
+ * When restoring: oauth is reset to the default portal config values
+ * (mirrors DEFAULT_PORTAL_CONFIG.oauth — password + standard OAuth on,
+ * magicLink off).
+ *
+ * Usage: bun set-portal-auth-methods.ts <disable|restore>
+ */
+import postgres from 'postgres'
+
+const arg = (process.argv[2] || '').toLowerCase()
+if (arg !== 'disable' && arg !== 'restore' && arg !== 'enable-magic-link') {
+  console.error('Usage: bun set-portal-auth-methods.ts <disable|restore|enable-magic-link>')
+  process.exit(1)
+}
+
+const connectionString = process.env.DATABASE_URL
+if (!connectionString) {
+  console.error('DATABASE_URL environment variable is required')
+  process.exit(1)
+}
+const sql = postgres(connectionString)
+
+try {
+  const rows = await sql`SELECT id, portal_config FROM settings ORDER BY created_at ASC LIMIT 1`
+  if (rows.length === 0) throw new Error('No settings row found')
+  const id = rows[0].id
+  let config: Record<string, unknown> = {}
+  if (rows[0].portal_config) {
+    try {
+      config = JSON.parse(rows[0].portal_config as string)
+    } catch {
+      config = {}
+    }
+  }
+
+  if (arg === 'disable') {
+    // Turn off every portal oauth method currently stored plus the core keys.
+    // Iterating existing keys handles any dynamic OAuth providers (custom-oidc, etc.)
+    // that may have been configured without this script knowing about them.
+    const existing = (config.oauth as Record<string, unknown>) ?? {}
+    const disabled: Record<string, unknown> = {}
+    for (const key of Object.keys(existing)) {
+      disabled[key] = false
+    }
+    // Ensure the canonical methods are explicitly disabled even if not yet stored.
+    disabled.password = false
+    disabled.magicLink = false
+    config.oauth = disabled
+  } else if (arg === 'enable-magic-link') {
+    // Enable only the magicLink method, leaving other settings untouched. Used
+    // by test setup that needs to sign in portal users (role='user') on repeat
+    // runs: the hooks check blocks magic-link for existing portal users when
+    // magicLink is off, so we open it just for the sign-in then restore.
+    const existing = (config.oauth as Record<string, unknown>) ?? {}
+    config.oauth = { ...existing, magicLink: true }
+  } else {
+    // Restore to the default portal oauth config (mirrors DEFAULT_PORTAL_CONFIG.oauth).
+    config.oauth = { password: true, email: false, google: true, github: true }
+  }
+
+  await sql`UPDATE settings SET portal_config = ${JSON.stringify(config)} WHERE id = ${id}`
+  console.log(JSON.stringify({ action: arg, oauth: config.oauth }))
+  await sql.end()
+} catch (err) {
+  console.error(err instanceof Error ? err.message : String(err))
+  await sql.end()
+  process.exit(1)
+}

apps/web/e2e/scripts/set-portal-visibility.ts

@@ -0,0 +1,54 @@
+/**
+ * CLI: set portal visibility to 'public' or 'private' in settings.portal_config.
+ * settings.portal_config is a JSON *text* column, so we read → patch → write.
+ * There is a single workspace settings row.
+ *
+ * When set to 'private': unauthenticated visitors hit the PortalAccessGate
+ * before seeing any portal content. Used by e2e tests that verify the gate
+ * renders with the dialog auto-opened (journey 3).
+ *
+ * Always restore to 'public' in a `finally` block so subsequent tests and
+ * dev sessions are not left with a locked portal.
+ *
+ * Usage: bun set-portal-visibility.ts <private|public>
+ */
+import postgres from 'postgres'
+
+const arg = (process.argv[2] || '').toLowerCase()
+if (arg !== 'private' && arg !== 'public') {
+  console.error('Usage: bun set-portal-visibility.ts <private|public>')
+  process.exit(1)
+}
+
+const connectionString = process.env.DATABASE_URL
+if (!connectionString) {
+  console.error('DATABASE_URL environment variable is required')
+  process.exit(1)
+}
+const sql = postgres(connectionString)
+
+try {
+  const rows = await sql`SELECT id, portal_config FROM settings ORDER BY created_at ASC LIMIT 1`
+  if (rows.length === 0) throw new Error('No settings row found')
+  const id = rows[0].id
+  let config: Record<string, unknown> = {}
+  if (rows[0].portal_config) {
+    try {
+      config = JSON.parse(rows[0].portal_config as string)
+    } catch {
+      config = {}
+    }
+  }
+
+  // Merge the visibility into the access sub-object, preserving other keys.
+  const existingAccess = (config.access as Record<string, unknown>) ?? {}
+  config.access = { ...existingAccess, visibility: arg }
+
+  await sql`UPDATE settings SET portal_config = ${JSON.stringify(config)} WHERE id = ${id}`
+  console.log(JSON.stringify({ action: 'set-portal-visibility', visibility: arg }))
+  await sql.end()
+} catch (err) {
+  console.error(err instanceof Error ? err.message : String(err))
+  await sql.end()
+  process.exit(1)
+}