# Slice 3: Authentication and Secrets

## Status

Not started

## Objective

Execute every MVP authentication type securely without exposing credentials to the browser or canonical project exports.

## Dependencies

- Existing REST proxy and authentication-type model
- Slice 2 authentication UI contract
- Deployment decision for secret provisioning

## In Scope

- Basic, Bearer, API-key header, API-key query, and anonymous authentication
- Server-side secret references, storage, resolution, redaction, and lifecycle

## Out of Scope

- OAuth 2.0, IBM Cloud IAM, mTLS, and arbitrary authentication scripts

## Tasks

- [ ] Define the MVP secret-reference model and threat assumptions.
- [ ] Select and document the server-side secret storage mechanism.
- [ ] Ensure project JSON contains references and metadata only.
- [ ] Implement safe secret create, update, lookup, and delete APIs.
- [ ] Implement Basic authentication injection.
- [ ] Implement Bearer token injection.
- [ ] Implement API-key header injection.
- [ ] Implement API-key query-parameter injection.
- [ ] Reject missing or incompatible references with structured errors.
- [ ] Redact credentials from logs, errors, history, and frontend responses.
- [ ] Exclude secrets from export and project CRUD responses.
- [ ] Add authentication, failure, and redaction tests.
- [ ] Update state, deployment, and security documentation.

## Acceptance Criteria

- [ ] All five modeled authentication modes execute as documented.
- [ ] Browser-visible traffic and exported JSON never contain stored credentials.
- [ ] Logs and errors redact sensitive values.
- [ ] Missing or invalid secret references fail safely and clearly.
- [ ] Secrets survive the intended MVP deployment lifecycle.

## Validation

- [ ] Backend TypeScript check passes.
- [ ] Authentication and redaction tests pass.
- [ ] Controlled mock-endpoint checks pass.
- [ ] Docker Compose secret provisioning and restart checks pass.

## Risks and Open Questions

- Plaintext secrets in SQLite require an explicit and acceptable MVP policy.
- Query API keys require special URL redaction.
- Secret ownership is limited in a single-user MVP.

## Progress Log

No work recorded yet.

## Handoff

- Last completed: Slice plan created.
- Next action: Write the threat model and select the MVP secret store.
- Known blockers: Secret storage and deployment policy need an explicit decision.