conductor/SLICE3.md

Slice 3: Authentication and Secrets

Status

Not started

Objective

Execute every MVP authentication type securely without exposing credentials to the browser or canonical project exports.

Dependencies

• Existing REST proxy and authentication-type model
• Slice 2 authentication UI contract
• Deployment decision for secret provisioning

In Scope

• Basic, Bearer, API-key header, API-key query, and anonymous authentication
• Server-side secret references, storage, resolution, redaction, and lifecycle

Out of Scope

• OAuth 2.0, IBM Cloud IAM, mTLS, and arbitrary authentication scripts

Tasks

• Define the MVP secret-reference model and threat assumptions.
• Select and document the server-side secret storage mechanism.
• Ensure project JSON contains references and metadata only.
• Implement safe secret create, update, lookup, and delete APIs.
• Implement Basic authentication injection.
• Implement Bearer token injection.
• Implement API-key header injection.
• Implement API-key query-parameter injection.
• Reject missing or incompatible references with structured errors.
• Redact credentials from logs, errors, history, and frontend responses.
• Exclude secrets from export and project CRUD responses.
• Add authentication, failure, and redaction tests.
• Update state, deployment, and security documentation.

Acceptance Criteria

• All five modeled authentication modes execute as documented.
• Browser-visible traffic and exported JSON never contain stored credentials.
• Logs and errors redact sensitive values.
• Missing or invalid secret references fail safely and clearly.
• Secrets survive the intended MVP deployment lifecycle.

Validation

• Backend TypeScript check passes.
• Authentication and redaction tests pass.
• Controlled mock-endpoint checks pass.
• Docker Compose secret provisioning and restart checks pass.

Risks and Open Questions

• Plaintext secrets in SQLite require an explicit and acceptable MVP policy.
• Query API keys require special URL redaction.
• Secret ownership is limited in a single-user MVP.

Progress Log

No work recorded yet.

Handoff

• Last completed: Slice plan created.
• Next action: Write the threat model and select the MVP secret store.
• Known blockers: Secret storage and deployment policy need an explicit decision.