docs(91b): auth-posture sign-off + rollback-tag procedure for Blazor removal (#205, #206) #261

2026-07-11T16:45:37+02:00

timothy commented

2026-07-11 16:45:37 +02:00

Resolves the two SHOULD-FIX gate findings from the #91 phase-(b) cold review by making the removal plan address them explicitly rather than clearing the gate by omission. Docs-only — no production code changes.

#206 — auth posture sign-off

Enumerated the actual authorization wiring in ErsatzTV/Startup.cs + ErsatzTV/Pages in code (not assumed):

OIDC (OidcHelper.IsEnabled, config-gated) attaches auth via AddRazorPages(… AuthorizeFolder("/")) + blazor.UseAuthentication/UseAuthorization — and AuthorizeFolder("/") gates Razor Pages only, whose sole user-facing page is Pages/_Host.cshtml (the Blazor host). The OIDC challenge protects exactly the Blazor UI, nothing else.
/app (SPA) — own MapWhen(/app) static branch, no auth middleware; open since phase (a) (PR #148).
/api/* — zero [Authorize] attributes (verified); only optional gate is ApiKeyAuthorizationFilter (independent of Blazor).
/iptv/* — ConditionalIptvAuthorizeFilter (JWT), own branch, independent of Blazor.

Verdict: removal deletes the OIDC challenge's only attachment point; no capability lost (each Blazor capability already has an open SPA equivalent), no NEW exposure beyond the phase-(a) state (open SPA already the default admin surface). Independent gates (/iptv JWT, API-key filter) survive. Real SPA/API auth deferred to #197. Recorded in docs/decisions.md.

#205 — pre-removal rollback tag

Documented the blazor-final annotated-tag procedure: cut at removal time on the pre-deletion main commit (not now — main moves first; not a v* tag → no release build), plus the restore path (checkout → docker build → pin test container, or revert the deletion merge). Recorded in docs/decisions.md.

Consolidation

Both fold into a new "Section 5 — Removal execution runbook" in docs/blazor-route-parity.md — an ordered checklist (rollback tag → surgical Blazor delete → auth sign-off pointer → verify+docs) so the (gated) removal PR just executes it.

Notes

The physical actions (cutting the tag, deleting the OIDC/Blazor pieces) remain the gated removal PR's job — this PR makes the plan complete and durable so they don't get missed.
Files: docs/decisions.md (+63), docs/blazor-route-parity.md (+25). No API/route/schema change → no OpenAPI/generated-artifact regen needed.

refs #205 #206 #91

🤖 Generated with Claude Code

Resolves the two SHOULD-FIX gate findings from the #91 phase-(b) cold review by making the removal plan **address them explicitly** rather than clearing the gate by omission. Docs-only — no production code changes. ## #206 — auth posture sign-off Enumerated the actual authorization wiring in `ErsatzTV/Startup.cs` + `ErsatzTV/Pages` **in code** (not assumed): - **OIDC** (`OidcHelper.IsEnabled`, config-gated) attaches auth via `AddRazorPages(… AuthorizeFolder("/"))` + `blazor.UseAuthentication/UseAuthorization` — and `AuthorizeFolder("/")` gates **Razor Pages only**, whose sole user-facing page is `Pages/_Host.cshtml` (the Blazor host). **The OIDC challenge protects exactly the Blazor UI, nothing else.** - **`/app` (SPA)** — own `MapWhen(/app)` static branch, **no auth middleware**; open since phase (a) (PR #148). - **`/api/*`** — zero `[Authorize]` attributes (verified); only optional gate is `ApiKeyAuthorizationFilter` (independent of Blazor). - **`/iptv/*`** — `ConditionalIptvAuthorizeFilter` (JWT), own branch, independent of Blazor. **Verdict:** removal deletes the OIDC challenge's only attachment point; **no capability lost** (each Blazor capability already has an open SPA equivalent), **no NEW exposure** beyond the phase-(a) state (open SPA already the default admin surface). Independent gates (`/iptv` JWT, API-key filter) survive. Real SPA/API auth deferred to **#197**. Recorded in `docs/decisions.md`. ## #205 — pre-removal rollback tag Documented the `blazor-final` annotated-tag procedure: cut at removal time on the pre-deletion `main` commit (not now — main moves first; not a `v*` tag → no release build), plus the restore path (checkout → docker build → pin test container, or revert the deletion merge). Recorded in `docs/decisions.md`. ## Consolidation Both fold into a new **"Section 5 — Removal execution runbook"** in `docs/blazor-route-parity.md` — an ordered checklist (rollback tag → surgical Blazor delete → auth sign-off pointer → verify+docs) so the (gated) removal PR just executes it. ## Notes - The physical actions (cutting the tag, deleting the OIDC/Blazor pieces) remain the **gated removal PR's** job — this PR makes the plan complete and durable so they don't get missed. - Files: `docs/decisions.md` (+63), `docs/blazor-route-parity.md` (+25). No API/route/schema change → no OpenAPI/generated-artifact regen needed. refs #205 #206 #91 🤖 Generated with [Claude Code](https://claude.com/claude-code)

timothy force-pushed feat/205-206-removal-prep from ca0ad1b42c to 7608cccebd

2026-07-11 17:09:40 +02:00

Compare

timothy merged commit 7608cccebd into main

2026-07-11 17:20:34 +02:00

timothy deleted branch feat/205-206-removal-prep

2026-07-11 17:20:34 +02:00

timothy referenced this pull request

2026-07-11 17:21:12 +02:00

Removal plan has no auth step: deleting the last challenged Blazor page leaves only the open SPA #206

timothy referenced this pull request

2026-07-11 17:21:21 +02:00