chore: delete the dead auth-config.json tail and the stray EFS RFC - #5579
Merged
Conversation
Auth moved to AUTH_* environment variables (auth-env.ts) — core/config.ts even warns that a config-file 'auth' key is ignored. Nothing reads auth-config.json anymore, but its tail survived everywhere: - auth-config.json at the repo root: snuck in via #5575 (a sandbox-daemon PR), tracked ever since, read by nothing. Deleted. - apps/api/auth-config.example.json, tests/resilience/auth-config.test.json: referenced by nothing. Deleted. - .github/workflows/e2e.yml wrote the file before every run — for nothing. Step deleted. - .cursor/worktrees.json copied a file that does not exist. Line deleted. - apps/api/src/auth/index.ts's header claimed the exact opposite of reality ('file-based, not environment variables'). Fixed, with the .gitignore entry, the AGENTS.md config line, and config.example.json's pointer. - deploy/helm/studio/README.md documented a configmap-auth.yaml template that does not exist in templates/. Section removed, following ones renumbered. efs-spec.md (an L2 golden-cache RFC draft) also landed at the root in #5575. Deleted — it was never referenced by anything in the repo. Not touched: decostudio-alias/ stays at the root on purpose — it is the published npm alias (decostudio → decocms) with its own publish workflow, and it must stay OUT of the workspaces globs so its 'decocms': '*' dependency resolves against the registry instead of being workspace-linked. spec/001.md's auth-config mentions are a historical design document and were left alone.
…othing The chart has had no template consuming .Values.configMap.authConfig or secret.authConfigSecretName since configmap-auth.yaml was deleted (#3048, env-var auth) — but the README and examples/secrets-example.yaml kept documenting both, including a second Secret with camelCase keys (googleClientId, resendApiKey) the server never reads. This is an active trap: the real prod values in deco-apps-cd carry a full authConfig block (google, resend, magic-link) that renders to nothing — auth there actually works because the ExternalSecret feeds AUTH_* keys via envFrom. README now shows the real mechanism (AUTH_* in meshConfig/Secret, schema in apps/api/src/auth/auth-env.ts) and the example Secret carries AUTH_* keys.
001.md described the file-based auth-config.json design that #3048/#5120 replaced with AUTH_* env vars, plus a pre-split architecture; nothing links to it except its README entry and one step of the add-mcp-tools skill, both removed (the skill's 'Document in Spec' step told contributors to document new tools in a file that described a system that no longer exists). monitoring-share-plugin.md was referenced by nothing at all.
Stale editor config from 2024 (last touched in #1218); the paths it excluded no longer exist in the repo.
viktormarinho
enabled auto-merge (squash)
August 3, 2026 03:15
decocms Bot
pushed a commit
that referenced
this pull request
Aug 3, 2026
![decocms-release[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
PR: #5579 chore: delete the dead auth-config.json tail and the stray EFS RFC Bump type: patch - decocms (apps/api/package.json): 4.160.6 -> 4.160.7 - @decocms/native (apps/native/package.json): 4.160.6 -> 4.160.7 Deploy-Scope: server
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root-of-repo cleanup. Two strays that landed via #5575 (a sandbox-daemon PR that swept in local files), plus the entire dead tail behind one of them.
auth-config.jsonis dead — everywhereAuth is configured by
AUTH_*environment variables (apps/api/src/auth/auth-env.ts);core/config.tsexplicitly warns and ignores anauthkey if it finds one in a config file. Nothing readsauth-config.json. Its tail, all deleted/fixed:auth-config.json(root)apps/api/auth-config.example.jsontests/resilience/auth-config.test.json.github/workflows/e2e.yml.cursor/worktrees.jsonapps/api/src/auth/index.tsheaderAGENTS.md(CLAUDE.md) config line,config.example.jsonpointer,.gitignoreentrydeploy/helm/studio/README.mdconfigmap-auth.yamltemplate that does not exist intemplates/— section removed, following sections renumbereddeploy/helm/studio/README.md+examples/secrets-example.yamlconfigMap.authConfigvalues and a seconddeco-studio-auth-secretsSecret with camelCase keys (googleClientId, …) — nothing in the chart consumes either (no template references them since #3048). Replaced with the real mechanism:AUTH_*env keys viaenvFromefs-spec.md— deletedAn L2 golden-cache RFC draft that landed at the root in #5575. Referenced by nothing in the repo.
decostudio-alias/— left at the root, on purposeAnswered while here: it's the published npm alias (
bunx decostudio→ runsdecocms) with its own publish workflow (publish-decostudio-npm.yaml). It lives at the root deliberately — the workspaces globs areapps/*andpackages/*, and moving it intopackages/would make it a workspace member, which would workspace-link its"decocms": "*"dependency to the local package instead of resolving against the npm registry. Not junk; not moved.apps/api/spec/— deletedInitially left as "historical", then confirmed useless:
001.mddescribes the file-basedauth-config.jsondesign that #3048/#5120 replaced withAUTH_*env vars, plus the pre-split architecture. Its two referrers went with it: theapps/apiREADME link, and theadd-mcp-toolsskill's "Document in Spec" step — which was instructing contributors to document new tools inside a spec describing a system that no longer exists.monitoring-share-plugin.mdhad zero referrers.Verified against the real deployment (decocms/deco-apps-cd)
Cloned the CD repo and checked how prod/stg actually configure auth. Both
apps/deco-studio/values.yamlanddeco-studio-stgcarry a fullconfigMap.authConfigblock (google, resend, magic-link) that renders to nothing — chart0.12.4(the exact pinned version) has no template consuming it. Auth works in prod because the ExternalSecret pullsAUTH_*keys from AWS Secrets Manager into the one K8s Secret the deploymentenvFroms. So: prod never depended on any of what this PR deletes, and the stale chart docs already claimed their first victim — the prod values file itself. (Cleaning those dead blocks out of deco-apps-cd is a follow-up in that repo.)Testing
bun run checkclean (all 14 workspaces),bun run lintat baseline,knipexit 0.bun test apps/api/src/authgreen.auth-configin tracked code: only the historical spec andapps/web's unrelatedauth-config-provider.tsx(a frontend provider, different thing that happens to share the name).