Bring authentication back into the app - #15
Merged
Merged
Conversation
Signing in through 3AG Accounts turned out to cost more than it saved: one more service to run, deploy and keep credentials for, to log into three apps that already knew how to log people in. So this puts back the authentication the app had before the move -- Fortify, with registration, password reset, email verification, two-factor and passkeys -- and drops the OIDC client entirely. Everything here is the pre-SSO code restored from 3d69e74, not a rewrite. What the SSO work deleted comes back as it was; what it added is gone: the Accounts controllers, config/oidc.php, the ACCOUNTS_* environment, and the accounts-oidc package along with the VCS repository entry that pulled it in. The schema needs a migration rather than a file deletion, because the SSO migrations have already run in production. The new one re-adds the two-factor columns and the passkeys table and drops `sso_id`, and guards every step so it is correct both on a database that went through the SSO migrations and on one built from scratch. Two things from that period are deliberately kept, because neither is about SSO: the app's own error pages, and the removal of a `verified` middleware that never did anything (this User has never implemented MustVerifyEmail, so EnsureEmailIsVerified passed everyone through). Anyone whose account was created by the SSO callback has a random password nobody holds; they will need the password reset flow, which is live again, to pick one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signing in through 3AG Accounts cost more than it saved: another service to run, deploy and hold credentials for, so that three apps that already knew how to log people in could log people in. This takes the OIDC client out and puts the app's own authentication back.
What comes back
Fortify, as it was before the move: registration, login, password reset, email verification, two-factor and passkeys, the security settings page, and an editable profile.
This is the pre-SSO code restored from
3d69e74, not a reimplementation — the deleted files return unchanged.What goes
AccountsSsoController,LoginController,LogoutController,config/oidc.php, theACCOUNTS_*environment, the3agapp/accounts-oidcrequirement and the VCS repository entry that pulled it in.Schema
A migration rather than a file deletion, because the SSO migrations have already run in production. It re-adds the two-factor columns and the
passkeystable and dropssso_id, guarding every step so it is correct both on a database that went through the SSO migrations and on one built from scratch. The suite migrates through the SSO migrations first, so it exercises exactly the production path.Deliberately kept
Two things from that period, because neither is about SSO:
ErrorBoundary;verifiedmiddleware that never did anything — thisUserhas never implementedMustVerifyEmail, soEnsureEmailIsVerifiedpassed everyone through. Say the word if you would rather have it back for symmetry.Before merging
Anyone whose account was created by the SSO callback holds a random password nobody knows. They will need the password reset flow, which is live again, to set one.
Verification
php artisan test— 298 passed, including the restored browser tests for login, registration and the two-factor challenge.🤖 Generated with Claude Code