P0 auth blocker

Production auth and OAuth readiness

Review the production auth provider decision, Google/Microsoft sign-in, staff MFA, session policy, step-up, and tenant/RLS handoff before live auth activation.

Otto Demo School

School Administrator · Sam Director

P0 auth blocker

Production auth and OAuth readiness

Local readiness proof for WorkOS versus Supabase, Google and Microsoft sign-in, staff-required MFA, student-optional MFA, session policy, step-up actions, and the tenant/RLS handoff after login.

Local proof, not live auth

This page does not create WorkOS, Google, Microsoft, Supabase, password, magic-link, one-time-code, OAuth, or MFA sessions. It keeps the production gates visible before live auth is enabled.

Provider decision

WorkOS

Recommended default with Supabase fallback and pricing re-check.

P0 sign-in methods

Email/password, one-time code, Google, and Microsoft.

Readiness tracks

Provider, OAuth, MFA, sessions, step-up, RLS, and support.

Activation gates

Items that stay blocked before live auth and tenant data access.

Readiness sources

Source documents used for auth readiness

7 sources

PRD authentication and roles

docs/prd/14-authentication-identity-and-roles.md

PRD authentication and roles

Evidence: Defines P0 sign-in methods, staff-required MFA, student-optional MFA, session settings, authorization, step-up actions, and support access grants.
Readiness use: Primary source for what production auth must support before pilot activation.

Founder and architecture decisions

docs/DECISIONS.md

Founder and architecture decisions

Evidence: Records Google and Microsoft sign-in as P0, WorkOS as the recommended provider, Supabase as fallback, Drizzle RLS proof, Otto-owned authorization, staff MFA policy, safe session metadata, and demo-login separation.
Readiness use: Keeps Sam's approved auth/OAuth direction visible while preserving production activation gates.

Auth provider price spike

docs/research/auth-provider-price-spike.md

Auth provider price spike

Evidence: Recommends WorkOS AuthKit from existing research, keeps Supabase as fallback, and documents the staff-only MFA caveat.
Readiness use: Used as the historical provider-cost basis; current pricing still needs a production re-check before contract execution.

Auth login and OAuth proof

docs/specs/007-auth-login-oauth/spec.md

Auth login and OAuth proof

Evidence: Defines WorkOS AuthKit callback/session handling, Google and Microsoft provider support through the hosted flow, platform identity mapping, and the no-tenant-access rule.
Readiness use: Confirms authentication is separate from tenant authorization.

Staff MFA and session proof

docs/specs/008-staff-mfa-proof/spec.md

Staff MFA and session proof

Evidence: Defines role-aware staff MFA, student-optional MFA, safe session/device metadata, configurable session defaults, and step-up guard behavior.
Readiness use: Confirms local policy shape without requiring real MFA enrollment in local proof.

Drizzle RLS proof

docs/specs/005-drizzle-rls-proof/spec.md

Drizzle RLS proof

Evidence: Documents Drizzle-managed RLS setup plus forced RLS, grants, no-bypass role hardening, and local pgTAP coverage.
Readiness use: Feeds the tenant isolation handoff after login and membership resolution.

Tenants, users, roles, and permissions

docs/specs/006-tenants-users-roles-permissions/spec.md

Tenants, users, roles, and permissions

Evidence: Separates platform users/auth identities from tenant memberships, roles, permission sets, and scope assignments.
Readiness use: Confirms Otto-owned authorization is the gate after WorkOS authenticates a person.

Provider decision

WorkOS primary, Supabase fallback, Otto authorization

4 decisions

WorkOS AuthKit

Recommended P0 provider

Decision: Use WorkOS AuthKit as the default Phase 1 provider unless the production pricing re-check or staff-only MFA validation fails.
Rationale: Existing research found WorkOS cheapest for the modeled P0 baseline, with Google/Microsoft sign-in, one-time-code auth, sessions, re-authentication, and a future SSO/directory path.
Production gate: Create real WorkOS environment, domains, callback/logout URLs, Google and Microsoft provider apps, and verify current pricing before contract execution.

Supabase Auth fallback

Fallback kept open

Decision: Keep Supabase Auth as the fallback if WorkOS cannot cleanly satisfy staff-required and student-optional MFA at the cheapest qualifying production price.
Rationale: Supabase has a strong Postgres/RLS fit and a clear MFA path, but existing research required a paid plan for P0 leaked-password protection and session controls.
Production gate: Only switch after a focused provider re-check covering current price, MFA, sessions, OAuth, tenant context, RLS, migration effort, and lock-in.

Otto-owned authorization

Required

Decision: Authentication proves a person; Otto memberships, roles, permissions, scopes, support grants, and active tenant selection decide access.
Rationale: WorkOS roles or claims must not replace school-specific permissions or grant tenant data access by themselves.
Production gate: Finish invitation, membership, active role, role switching, support grant, and permission enforcement before live school access.

Demo login separation

Local only

Decision: Demo login remains a local-only seeded fake-school shortcut and cannot become a production auth bypass.
Rationale: Sam needs reviewable persona switching before production invitations exist, but real auth remains WorkOS or the selected production provider.
Production gate: Keep demo access gated by local flags and production refusal; do not create WorkOS, Google, Microsoft, or MFA sessions from demo login.

P0 readiness tracks

What is proved locally and what still needs provider setup

9 tracks

WorkOS environment and callback

Local proof present

P0 requirement: Provider-hosted auth with safe callback/session handling and no committed secrets.
Local proof: Ticket 007 config, callback, not-configured state, platform identity mapping, and redirect allowlist tests.
Production readiness: Needs production WorkOS project, domain settings, secure cookie password, callback/logout URLs, and secret rotation plan.

Google Workspace sign-in

P0 provider setup needed

P0 requirement: Google sign-in is P0 and should be available through the selected provider flow.
Local proof: Ticket 007 documents Google support through hosted AuthKit; no local Google OAuth app or credential is committed.
Production readiness: Create Google OAuth app, configure allowed domains and redirect URLs, and test a real credential in a non-production environment.

Microsoft Entra sign-in

P0 provider setup needed

P0 requirement: Microsoft sign-in is P0 and should be available through the selected provider flow.
Local proof: Ticket 007 documents Microsoft support through hosted AuthKit; no local Microsoft OAuth app or credential is committed.
Production readiness: Create Microsoft Entra app, configure allowed tenants/scopes/redirects, and test a real credential in a non-production environment.

Staff-required MFA

Policy proof present

P0 requirement: Staff, instructors, administrators, support, and other workforce roles require MFA.
Local proof: Ticket 008 proves MFA requirement from Otto membership role slugs rather than global provider roles.
Production readiness: Wire provider MFA enrollment/challenge/verification, enforce server-side gates, and confirm WorkOS does not force all students through required MFA.

Student-optional MFA

Policy proof present

P0 requirement: Student-only users may be offered MFA but are not blocked by the staff MFA rule.
Local proof: Ticket 008 includes student-only and mixed-role policy tests.
Production readiness: Add final Security settings copy, optional enrollment flows, recovery rules, and support procedure before live rollout.

Session policy and safe metadata

Scaffold present

P0 requirement: Schools need configurable session timeouts, session/device metadata, and no token or code storage.
Local proof: Ticket 008 resolves school defaults and stores safe hashes/labels instead of tokens, one-time codes, TOTP secrets, QR payloads, raw IPs, or provider dumps.
Production readiness: Connect school Security settings, audit events, secret management, and real provider session metadata.

Step-up actions

Guard scaffold present

P0 requirement: Sensitive actions require recent authentication and MFA where policy requires it.
Local proof: Ticket 008 step-up helper fails closed when auth_time is missing, stale, or MFA is unsatisfied.
Production readiness: Apply to payout/Stripe settings, bulk exports, role changes, attendance lock edits, refund approvals, rule-pack activation, credential issue, restricted records, support grants, and view-as-role.

Tenant and RLS handoff

Architecture proof present

P0 requirement: Login alone creates no tenant access; tenant-owned data requires active membership, selected tenant, withTenant, and forced RLS.
Local proof: Tickets 005, 006, and 007 separate auth identity from memberships and prove forced RLS patterns.
Production readiness: Extend RLS coverage to every tenant-owned table and run tenant isolation regression checks before production data access.

Support access grants

Activation blocked

P0 requirement: Otto support access requires school grant, visible logging, expiry, and restricted-data boundaries.
Local proof: PRD and access-report proofs keep support access out of normal login and visible to school administrators.
Production readiness: Implement grant creation, expiry, revocation, support role scope, audit logging, and restricted-data redaction.

Tenant and RLS handoff

Login creates no tenant access

5 handoffs

Provider subject to platform identity

Ticket 007 proof

From: Verified WorkOS subject
To: otto_private.users and otto_private.auth_identities
Contract: Create or reuse one platform identity; fail closed on conflicts; do not create tenants, memberships, roles, permissions, or scopes.

Platform identity to active membership

Ticket 006 foundation

From: Otto platform user
To: Active tenant membership, role set, scopes, and selected role
Contract: Authorization is resolved from Otto data, not provider claims; disabled or expired memberships do not grant access.

Active membership to tenant context

Architecture required

From: Selected school membership
To: Request-scoped tenant context
Contract: Tenant-owned queries use withTenant; button visibility is never the access control.

Tenant context to forced RLS

Ticket 005 pattern

From: withTenant request context
To: Postgres app.tenant_id and forced row-level security
Contract: Every tenant-owned table needs tenant_id, forced RLS, policies, grants, and no-bypass regression tests.

Session to sensitive action

Ticket 008 scaffold

From: Recent auth_time plus MFA policy
To: Step-up-gated product action
Contract: High-risk actions fail closed without fresh auth and required MFA, even if the UI route is visible.

Activation gates

What blocks live auth and tenant data access

9 gates

Current provider pricing check

Blocks contract

Why it matters: Sam approved choosing WorkOS or Supabase based on the cheapest qualifying P0 option, and pricing can change.
Owner: Sam and platform
Next action: Recheck official WorkOS and Supabase pricing before production contract execution; document any change to the provider decision.

Production WorkOS configuration

Blocks live auth

Why it matters: Local proof has no real provider project, production domain, callback URL, logout URL, cookie secret, or secret rotation plan.
Owner: Platform
Next action: Create production and staging WorkOS apps, configure redirect/logout URLs, store secrets, and verify not-configured failure paths.

Google OAuth app

Blocks P0 OAuth

Why it matters: Google sign-in is P0, but local proof cannot create or validate the real Google provider credentials.
Owner: Platform and Sam
Next action: Create Google OAuth app, configure provider settings in WorkOS or fallback provider, and test with a real non-production user.

Microsoft Entra app

Blocks P0 OAuth

Why it matters: Microsoft sign-in is P0, but local proof cannot create or validate the real Microsoft provider credentials.
Owner: Platform and Sam
Next action: Create Microsoft Entra app, configure provider settings in WorkOS or fallback provider, and test tenant/domain behavior.

Staff MFA provider validation

Blocks workforce rollout

Why it matters: Otto must require staff MFA without forcing every student through a global required-MFA setting.
Owner: Security and platform
Next action: Validate WorkOS standalone MFA or re-auth primitives for staff-required and student-optional flows; keep Supabase fallback open if this fails.

Invitation and membership lifecycle

Blocks school access

Why it matters: Login creates no tenant access; production needs invitation, membership, role, active school, and deactivation lifecycle.
Owner: Platform and school admin
Next action: Implement invitation acceptance, active membership resolution, role switching, deactivation, and audit events.

Full tenant RLS regression

Blocks production data

Why it matters: Auth is only safe when every tenant-owned table enforces request-scoped tenant access in the database.
Owner: Platform and security
Next action: Extend forced RLS, policies, grants, no-bypass checks, and pgTAP coverage to production tenant tables.

Step-up enforcement on real actions

Blocks high-risk actions

Why it matters: Payout settings, exports, role changes, attendance corrections, refunds, rule-pack activation, credentials, support grants, and view-as-role are high-risk.
Owner: Platform and product
Next action: Attach step-up guard to each sensitive server action and verify missing or stale auth fails closed.

Support access grant controls

Blocks support access

Why it matters: Otto support must not receive broad school data access through normal auth or hidden impersonation.
Owner: Support, security, and platform
Next action: Build school-granted support access with expiry, audit log visibility, revocation, and restricted-data redaction.

Proof boundary

No production credentials or provider sessions

No production credentials

This is deterministic local auth readiness proof, not live provider activation.
No WorkOS, Google, Microsoft, Supabase, password, magic-link, one-time-code, MFA, or OAuth credential is created by this page.
Existing research recommends WorkOS, but current official pricing still must be rechecked before production contract execution.
Authentication alone creates no tenant access; production access still requires Otto memberships, roles, scopes, selected tenant context, withTenant, and forced RLS.
Demo login remains local-only and does not create provider sessions, MFA enrollment, OAuth accounts, support grants, or production audit persistence.