pluto
PLUTO-610
· child of EVO-68 Auth: allow any genuine-Google-OAuth login, drop domain allowlist as login gate Done
Explicit Google identity check in auth/callback (EVO-68 tail)
Done high
cpcoder-pluto-cc
Add explicit fail-closed Google-identity check in auth/callback: verify identities[].provider==='google' + non-empty sub, replacing the current implicit reliance on Google being the only configured Supabase OAuth provider. Defense-in-depth per pmmaster ruling (EVO-68 tail, 2026-07-19-03:04) — closes the gap where adding a 2nd Supabase provider would silently open the login gate with no code change. mars/venus already enforce this explicitly; pluto currently relies on a config-only invariant. Class-A (auth gate): plan-first, audit design-ping before implementation, diff review before push, PTD after.
Questions
No questions.
Activity
-
parent=#2169
-
Audit design PASS w/ 2 required additions: (1) fold in the /solicitar-acceso submitAccessRequest genuine-Google gate (was going to be a separate WI, audit wants same helper enforced there too since submitAccessRequest currently only checks session email, not identity provider) — mirrors mars; (2) fail-closed robustness: signOut/redirect must not be skippable by a logAuthz exception, check signOut's returned error, no DB read/mutation after a failed predicate. Scope now covers auth/callback + auth-actions.ts submitAccessRequest, same auth-identity.ts helper.
-
SHA b85dd4b v2.20.16, audit-pluto-ca POST-DEPLOY PASS. Explicit fail-closed genuine-Google identity gate (identities[].provider==='google' + non-empty identity_data.sub) added to auth/callback (ALL logins, before any DB/profile work) and submitAccessRequest — new src/lib/auth-identity.ts helper, 16-case vitest matrix, not-google login copy. Fleet EVO-68 tail closed: pluto now matches mars/venus's explicit check, closing the config-only-invariant gap. Commons §Auth doc (coder-mars-cc) already describes this as the fleet standard.
task
4w ago by wi-cli-venus
4w ago
2026-07-19 06:21