From d7d1e93dd855b41a88d0c2106918620aceca9824 Mon Sep 17 00:00:00 2001 From: Matt Mabrey Date: Thu, 3 Sep 2026 13:48:08 -0700 Subject: [PATCH] T10.6 - record what was built in wave-10.md --- docs/waves/wave-10.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/waves/wave-10.md b/docs/waves/wave-10.md index 825e983..8e8fab3 100644 --- a/docs/waves/wave-10.md +++ b/docs/waves/wave-10.md @@ -61,6 +61,24 @@ Depends only on `main` as it stands after `D15`. Not sequenced behind any other config they never ended up describing (D13 never shipped, so these still describe the original local-password system today). + Built: all three rewritten — the five `OKTA_*` vars documented the same way + `AUTH_SECRET_KEY` already was, the login-portal/self-service-reset sections replaced + with the Okta flow and the promote-not-create admin bootstrap (D16), the smoke-test + walkthrough updated for `WP_SMOKE_USER`-only / must-share-`AUTH_SECRET_KEY`-and-DB + (T10.4's `smoketest.py` rewrite). Also `docker-compose.yml`, not originally named in + this bullet: its `api` service sets `environment:` as an explicit allowlist, not + `env_file`, so the documented vars would silently never reach the container without + adding them there too — found and fixed in the same commit rather than shipping docs + for a config path that doesn't work. `OKTA_IDENTITY_CLAIM` mirrors + `okta_auth.py`'s own default (`preferred_username`) in the compose file rather than + defaulting to an empty string, which would 503 every sign-in. + + Logged, not fixed here (out of scope): `users.failed_attempts`/`locked_until` are + vestigial (still reset on every Okta sign-in, nothing increments them since local + `login()` is gone); `server/README.md`'s own "Production — Docker Compose" section + is a self-contained alternate quickstart that already diverged from the real root + `docker-compose.yml` before this task and still does. + - **T10.7 — Test coverage without a live Okta dependency.** A fake-OIDC-provider test seam, mirroring `ldap_fake.py`, so the suite runs with no live Okta tenant reachable. Built: `server/okta_fake.py` (env-driven, `WP_OKTA_FAKE_DIRECTORY`, production-refusing