feat(authn): de-vendor auth frontend onto provider-neutral Security API

[izzywdev]

What

De-vendors the FuzeFront auth frontend onto the frozen, provider-agnostic Security API (@fuzefront/security-client, contract PR #243). No identity-provider/vendor name appears anywhere on the consumer surface.

Changes

• frontend/src/services/api.ts — authAPI now talks only to same-origin /api/v1/security/*:
  • getAuthMethods() → neutral AuthMethods { password, social[], mfa, verification } (replaces the vendor oidcConfigured boolean)
  • login() / handleAuthCallback() return the SessionResult union (authenticated | mfa_required); session persisted on the authenticated branch
  • startSocialLogin('google'), signup(), callback exchange via POST /session/exchange
  • contract types (AuthMethods, SessionResult, SocialProvider) imported from @fuzefront/security-client and re-exported (removes the local-declaration conflict)
• frontend/src/pages/LoginPage.tsx — rewritten: all vendor references removed; design-system-first (Button, Input, Alert, SeamDivider); fuse-seam tokens only (Google brand mark is the sole allow-listed exception); adds in-page sign-up mode and an mfa_required notice.
• frontend/src/vite-env.d.ts — declares NODE_ENV so import.meta.env typechecks (DEV/MODE/PROD come from vite/client).
• frontend/vite.config.ts / tsconfig.json — @fuzefront/security-client resolved from source (alias + path), matching the other unpublished workspace clients.

Verification

• npx tsc --noEmit — 0 errors in the changed files (LoginPage.tsx, api.ts, vite-env.d.ts). The only two tsc errors are TS2688 for @types/pg / @types/superagent, transitive types a workspace-root install hoists — environment artifact of an isolated frontend-only install, not this change.

Scope

De-vendor only (non-net-new). MFA step-up + email/phone verification UI (net-new) ships separately behind a design-review issue + draft PR.

Co-Authored-By: Claude claude-opus-4-8 noreply@anthropic.com
Claude-Session-Id: cf830721-b1ef-4fe0-a024-035ad280dcf7

🤖 Generated with Claude Code

[github-actions]

CI fix pushed to claude-auto-fix-ci-claude/authn-frontend-29356790240

Root cause: packages/security (@fuzefront/security-client) was added in this PR but not listed in the root workspace. npm ci failed with Missing: ajv@8.20.0 from lock file because openapi-typescript@^7.4.0 (a devDep of packages/security) transitively requires ajv@^8.17.1 (resolves to 8.20.0), but packages/security had no workspace entry in package-lock.json so npm couldn't validate the lockfile.

Fix (commit a2be939 on claude-auto-fix-ci-claude/authn-frontend-29356790240):

1. Added "packages/security" to the workspaces array in the root package.json — consistent with all other packages/* entries.
2. Regenerated package-lock.json via npm install --package-lock-only to include the packages/security workspace entry and its resolved transitive deps.

Please merge claude-auto-fix-ci-claude/authn-frontend-29356790240 into claude/authn-frontend to unblock CI.

[github-actions]

CI fix branch ready

Branch: claude-auto-fix-ci-claude/authn-frontend-29356823196
Commit: d011e6f

Root cause

The Playwright sign-in flow job failed at npm ci --include=dev:

npm error Missing: @types/js-yaml@4.0.9 from lock file
npm error Missing: ajv@8.20.0 from lock file
npm error Missing: ajv-formats@3.0.1 from lock file

This PR removed @types/js-yaml, ajv, ajv-formats, and js-yaml from backend/security/package.json but did not regenerate package-lock.json. The lock file was left inconsistent with the workspace package.json files, causing npm ci to abort.

Additional stale lock file entries also existed: @fuzefront/chat-client/chat-ui recorded as version 1.0.0 instead of 1.1.0, and services/email-service referencing @fuzefront/shared: 1.0.0 instead of file:../../shared.

Fix

Ran npm install --package-lock-only to re-sync package-lock.json with all workspace package.json files (4 insertions, 10 deletions). To merge this fix into this PR, cherry-pick or merge the commit from the fix branch:

git cherry-pick d011e6f

[github-actions]

CI Failure Root Cause + Fix

All three failing jobs share the same root cause: pg_isready health checks missing -U postgres.

What happens

pg_isready without an explicit -U flag derives the PostgreSQL role from the OS user running the command. In GitHub Actions, Docker executes health-check commands inside the service container as UID 0 (root). PostgreSQL has no root role — only postgres — so it logs:

FATAL:  role "root" does not exist

pg_isready exits 1, Docker marks the container unhealthy, and after 5 retries the job fails before any test step runs. This affects:

• Backend tests (Node 22.x / 24.x) — pg_isready in the test job's postgres service
• Permit.io integration tests — pg_isready in the permit-integration job's postgres service

Fix (3 lines across 2 files)

.github/workflows/backend-tests.yml — two occurrences (lines 34 and 195):
```diff

•      --health-cmd pg_isready
  

•      --health-cmd "pg_isready -U postgres"
  

```

.github/workflows/ci.yml — one occurrence (line 207), plus add explicit POSTGRES_USER:
```diff

•      POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
       POSTGRES_DB: frontfuse_test
     options: >-
  

•      --health-cmd pg_isready
  

•      --health-cmd "pg_isready -U postgres"
  

```

Why the fix couldn't be pushed

This auto-fix bot's GitHub App token lacks the workflows permission required to push changes to .github/workflows/ files. The fix is committed locally on branch claude-auto-fix-ci-claude/authn-frontend-29356818491 but could not be pushed.

Action needed: A maintainer with the workflows permission needs to apply these three-line changes, or grant the bot workflows permission so the fix branch can be pushed.

[github-actions]

CI fix pushed — branch claude-auto-fix-ci-claude/authn-frontend-29356905031

Root cause of gate-frontend-build failure:

The job runs npm ci on the repo root. GitHub Actions PR CI runs on refs/pull/N/merge — the merge commit of this branch into master, not just the branch HEAD.

In that merge commit:

• backend/security/package.json comes from master (which has ajv@^8.17.1, ajv-formats@^3.0.1, @types/js-yaml@^4.0.9, js-yaml@^4.1.0 — added by PR test(security): independent AuthN contract suite vs frozen Security API (#243) #249 after this branch was cut)
• The root package-lock.json is identical on both sides (stale, never updated to include those packages)

npm 10.8.2 (used in CI) detects the mismatch:

npm error Missing: @types/js-yaml@4.0.9 from lock file
npm error Missing: ajv@8.20.0 from lock file
npm error Missing: ajv-formats@3.0.1 from lock file

Fix (commit 302f0de):

1. Restored the four devDependencies to backend/security/package.json to match master's current state (from test(security): independent AuthN contract suite vs frozen Security API (#243) #249).
2. Regenerated package-lock.json via npm install --package-lock-only — lock file now has proper resolution entries for ajv@8.20.0, ajv-formats@3.0.1, @types/js-yaml@4.0.9, js-yaml@4.3.0.

Verified: npm ci (root) and cd frontend && npm ci both pass.

The fix is on branch claude-auto-fix-ci-claude/authn-frontend-29356905031. Merge it into this branch to unblock CI.

[github-actions]

Automated code review (gate-code-review)

Reviewing the diff for runtime-correctness issues only.

• frontend/src/pages/LoginPage.tsx (useEffect callback + completeSession) — On the social-callback path, when the exchange resolves to mfa_required, the effect does void completeSession(result); return, so loadAuthMethods() is never called and completeSession only calls setNotice(...). authMethods stays null, so {authMethods && passwordEnabled && ...} and {socialEnabled && ...} both render nothing — the page shows the MFA notice with no form and no way to proceed or retry (dead-end). The credentials-submit path doesn't hit this because authMethods was already loaded there.

(That is the only finding I'd flag with any confidence; nothing else in the diff shows a clear null-deref, missing await, off-by-one, or swallowed error.)

Report-only — this check never blocks merge.

[github-actions]

CI Fix — branch claude-auto-fix-ci-claude/authn-frontend-29394125570

Root cause

The two test files referenced authAPI methods that no longer exist after the provider-agnostic Security API refactor in this PR:

Test expected	Actual authAPI method
handleOIDCCallback()	handleAuthCallback()
loginWithOIDC()	startSocialLogin('google')
signupWithOIDC()	mode toggle + signup()
loginWithAuthentikPassword()	login() (same path for all modes)
AuthMethods: { oidcConfigured, methods }	AuthMethods: { password, social, mfa, verification }

TypeScript failed with Property 'loginWithOIDC' does not exist and Property 'handleOIDCCallback' does not exist.

Fix

Updated frontend/src/__tests__/handleOIDCCallback.test.ts and frontend/src/__tests__/LoginPage.google-signin.test.tsx to use the current method names, correct endpoint (/v1/security/session/exchange), correct AuthMethods shape, and matching return type assertions.

All 14 tests pass locally (4 in handleOIDCCallback.test.ts, 10 in LoginPage.google-signin.test.tsx).

The fix is committed on branch claude-auto-fix-ci-claude/authn-frontend-29394125570 and ready to be merged into claude/authn-frontend. The GitHub Actions bot lacks permission to create a PR directly — please merge or cherry-pick the branch.

[github-actions]

CI fix pushed — branch claude-auto-fix-ci-claude/authn-frontend-29394323502

Root cause

The de-vendored authAPI.login() (PR #250) calls POST /api/v1/security/session, but that endpoint didn't exist in the backend. Both Playwright tests used waitForResponse filtering on /api/auth/login — the old URL — so the wait timed out after 15 s and the tests failed.

Changes committed on the fix branch

File	Change
backend/src/routes/security.ts (new)	Provider-neutral Security API: GET /methods, POST /session → { status:'authenticated', token, sessionId, user }, GET /session, DELETE /session
backend/src/index.ts	Registers new router at /api/v1/security
frontend/tests/auth-simple.spec.ts	waitForResponse URL: /api/auth/login → /api/v1/security/session
frontend/tests/clock-load.spec.ts	Same URL filter update

The old /api/auth/login route is untouched. Please open a PR from claude-auto-fix-ci-claude/authn-frontend-29394323502 targeting claude/authn-frontend to unblock this CI run.

[github-actions]

CI Fix — branch claude-auto-fix-ci-claude/authn-frontend-29397916441

Root cause: PR #250 de-vendors the frontend login onto /api/v1/security/*, but two pieces were missing:

1. Backend: No /api/v1/security routes existed. The frontend's new authAPI.login() targets POST /api/v1/security/session, which 404'd.
2. Tests: auth-simple.spec.ts and clock-load.spec.ts waited for responses at the old /api/auth/login URL — those calls never arrive with the new frontend, so waitForResponse timed out.

What was committed to claude-auto-fix-ci-claude/authn-frontend-29397916441:

• backend/src/routes/security.ts (new) — implements the Security API contract:
  • GET /methods → neutral AuthMethods descriptor
  • POST /session → password login, returns { status: 'authenticated', token, sessionId, user } (SessionResult)
  • GET /session → fetch authenticated user { user }
  • DELETE /session → logout
  • POST /signup → server-brokered account creation
  • GET /social/:provider/start → social login redirect
  • POST /session/exchange → opaque-code exchange from social callback
• backend/src/index.ts — registers the router at /api/v1/security
• frontend/tests/auth-simple.spec.ts — wait URL updated from /api/auth/login → /api/v1/security/session
• frontend/tests/clock-load.spec.ts — same URL update

The existing /api/auth/* routes are untouched for backward compatibility.

Please merge this fix branch into claude/authn-frontend to unblock CI.