ambient-code
diff --git a/‎.github/workflows/e2e.yml‎
Lines changed: 71 additions & 1 deletion b/‎.github/workflows/e2e.yml‎
Lines changed: 71 additions & 1 deletion
diff --git a/‎.specify/memory/constitution_update_checklist.md‎
Lines changed: 1 addition & 1 deletion b/‎.specify/memory/constitution_update_checklist.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.specify/scripts/bash/check-prerequisites.sh‎
Lines changed: 6 additions & 6 deletions b/‎.specify/scripts/bash/check-prerequisites.sh‎
Lines changed: 6 additions & 6 deletions
diff --git a/‎.specify/scripts/bash/common.sh‎
Lines changed: 0 additions & 1 deletion b/‎.specify/scripts/bash/common.sh‎
Lines changed: 0 additions & 1 deletion
diff --git a/‎.specify/scripts/bash/create-new-feature.sh‎
Lines changed: 20 additions & 20 deletions b/‎.specify/scripts/bash/create-new-feature.sh‎
Lines changed: 20 additions & 20 deletions
diff --git a/‎.specify/scripts/bash/setup-plan.sh‎
Lines changed: 7 additions & 8 deletions b/‎.specify/scripts/bash/setup-plan.sh‎
Lines changed: 7 additions & 8 deletions
@@ -242,10 +242,80 @@ jobs:
         echo "Checking services..."
         kubectl get svc -n ambient-code
 
-    - name: Run Cypress E2E tests
+    - name: Run Cypress E2E tests (legacy auth)
       working-directory: e2e
       run: ./scripts/run-tests.sh
 
+    - name: Toggle SSO auth mode
+      run: |
+        # Verify Keycloak is healthy before toggling (backend needs it for OIDC discovery)
+        echo "Verifying Keycloak is ready..."
+        kubectl wait --for=condition=available --timeout=60s deployment/keycloak -n ambient-code
+
+        # Enable SSO on frontend
+        kubectl set env deployment/frontend -n ambient-code SSO_ENABLED=true NEXT_PUBLIC_SSO_ENABLED=true
+
+        # Enable SSO feature flag in Unleash
+        UNLEASH_ADMIN_TOKEN=$(kubectl get secret unleash-credentials -n ambient-code -o jsonpath='{.data.admin-api-token}' | base64 -d)
+        kubectl port-forward -n ambient-code svc/unleash 4242:4242 &
+        PF=$!
+        sleep 3
+        # Create flag if it doesn't exist, then enable
+        curl -sf -X POST "http://localhost:4242/api/admin/projects/default/features" \
+          -H "Authorization: $UNLEASH_ADMIN_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"name":"sso-authentication","type":"release"}' 2>/dev/null || true
+        curl -sf -X POST "http://localhost:4242/api/admin/projects/default/features/sso-authentication/environments/development/strategies" \
+          -H "Authorization: $UNLEASH_ADMIN_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"name":"default","parameters":{}}' 2>/dev/null || true
+        curl -sf -X POST "http://localhost:4242/api/admin/projects/default/features/sso-authentication/environments/development/on" \
+          -H "Authorization: $UNLEASH_ADMIN_TOKEN" 2>/dev/null || true
+        kill $PF 2>/dev/null || true
+
+        # Wait for frontend rollout
+        kubectl rollout status deployment/frontend -n ambient-code --timeout=60s
+
+        # Restart backend to pick up flag change faster
+        kubectl rollout restart deployment/backend-api -n ambient-code
+        kubectl rollout status deployment/backend-api -n ambient-code --timeout=60s
+
+        # Verify backend JWT validator initialized (OIDC discovery reached Keycloak)
+        echo "Verifying backend SSO initialization..."
+        for i in $(seq 1 15); do
+          if kubectl logs -n ambient-code -l app=backend-api --tail=50 2>/dev/null | grep -q "SSO: JWT validator initialized"; then
+            echo "Backend JWT validator initialized"
+            break
+          fi
+          if [ "$i" -eq 15 ]; then
+            echo "WARNING: Backend JWT validator may not have initialized"
+            kubectl logs -n ambient-code -l app=backend-api --tail=20 | grep -i sso || true
+          fi
+          sleep 2
+        done
+
+    - name: Run Cypress E2E tests (SSO auth)
+      working-directory: e2e
+      env:
+        E2E_USE_SSO: "true"
+      run: |
+        # Re-extract token using Keycloak client_credentials
+        ./scripts/extract-token.sh
+        # Verify frontend is healthy after SSO toggle before running tests
+        echo "Waiting for frontend to be ready with SSO..."
+        for i in $(seq 1 30); do
+          if curl -sf -o /dev/null http://localhost/api/version 2>/dev/null; then
+            echo "Frontend ready"
+            break
+          fi
+          if [ "$i" -eq 30 ]; then
+            echo "Frontend not ready after 60s"
+            kubectl logs -n ambient-code -l app=frontend --tail=20 || true
+            exit 1
+          fi
+          sleep 2
+        done
+        ./scripts/run-tests.sh
 
     - name: Upload test results
       if: failure()
 
@@ -82,4 +82,4 @@ Last sync check: 2025-07-16
 
 ---
 
-*This checklist ensures the constitution's principles are consistently applied across all project documentation.*
+*This checklist ensures the constitution's principles are consistently applied across all project documentation.*
@@ -57,13 +57,13 @@ OPTIONS:
 EXAMPLES:
   # Check task prerequisites (plan.md required)
   ./check-prerequisites.sh --json
-  
+
   # Check implementation prerequisites (plan.md + tasks.md required)
   ./check-prerequisites.sh --json --require-tasks --include-tasks
-  
+
   # Get feature paths only (no validation)
   ./check-prerequisites.sh --paths-only
-  
+
 EOF
             exit 0
             ;;
@@ -147,19 +147,19 @@ if $JSON_MODE; then
         json_docs=$(printf '"%s",' "${docs[@]}")
         json_docs="[${json_docs%,}]"
     fi
-    
+
     printf '{"FEATURE_DIR":"%s","AVAILABLE_DOCS":%s}\n' "$FEATURE_DIR" "$json_docs"
 else
     # Text output
     echo "FEATURE_DIR:$FEATURE_DIR"
     echo "AVAILABLE_DOCS:"
-    
+
     # Show status of each potential document
     check_file "$RESEARCH" "research.md"
     check_file "$DATA_MODEL" "data-model.md"
     check_dir "$CONTRACTS_DIR" "contracts/"
     check_file "$QUICKSTART" "quickstart.md"
-    
+
     if $INCLUDE_TASKS; then
         check_file "$TASKS" "tasks.md"
     fi
 
@@ -153,4 +153,3 @@ EOF
 
 check_file() { [[ -f "$1" ]] && echo "  ✓ $2" || echo "  ✗ $2"; }
 check_dir() { [[ -d "$1" && -n $(ls -A "$1" 2>/dev/null) ]] && echo "  ✓ $2" || echo "  ✗ $2"; }
-
@@ -10,8 +10,8 @@ i=1
 while [ $i -le $# ]; do
     arg="${!i}"
     case "$arg" in
-        --json) 
-            JSON_MODE=true 
+        --json)
+            JSON_MODE=true
             ;;
         --short-name)
             if [ $((i + 1)) -gt $# ]; then
@@ -40,7 +40,7 @@ while [ $i -le $# ]; do
             fi
             BRANCH_NUMBER="$next_arg"
             ;;
-        --help|-h) 
+        --help|-h)
             echo "Usage: $0 [--json] [--short-name <name>] [--number N] <feature_description>"
             echo ""
             echo "Options:"
@@ -54,8 +54,8 @@ while [ $i -le $# ]; do
             echo "  $0 'Implement OAuth2 integration for API' --number 5"
             exit 0
             ;;
-        *) 
-            ARGS+=("$arg") 
+        *)
+            ARGS+=("$arg")
             ;;
     esac
     i=$((i + 1))
@@ -83,30 +83,30 @@ find_repo_root() {
 # Function to check existing branches (local and remote) and return next available number
 check_existing_branches() {
     local short_name="$1"
-    
+
     # Fetch all remotes to get latest branch info (suppress errors if no remotes)
     git fetch --all --prune 2>/dev/null || true
-    
+
     # Find all branches matching the pattern using git ls-remote (more reliable)
     local remote_branches=$(git ls-remote --heads origin 2>/dev/null | grep -E "refs/heads/[0-9]+-${short_name}$" | sed 's/.*\/\([0-9]*\)-.*/\1/' | sort -n)
-    
+
     # Also check local branches
     local local_branches=$(git branch 2>/dev/null | grep -E "^[* ]*[0-9]+-${short_name}$" | sed 's/^[* ]*//' | sed 's/-.*//' | sort -n)
-    
+
     # Check specs directory as well
     local spec_dirs=""
     if [ -d "$SPECS_DIR" ]; then
         spec_dirs=$(find "$SPECS_DIR" -maxdepth 1 -type d -name "[0-9]*-${short_name}" 2>/dev/null | xargs -n1 basename 2>/dev/null | sed 's/-.*//' | sort -n)
     fi
-    
+
     # Combine all sources and get the highest number
     local max_num=0
     for num in $remote_branches $local_branches $spec_dirs; do
         if [ "$num" -gt "$max_num" ]; then
             max_num=$num
         fi
     done
-    
+
     # Return next number
     echo $((max_num + 1))
 }
@@ -136,19 +136,19 @@ mkdir -p "$SPECS_DIR"
 # Function to generate branch name with stop word filtering and length filtering
 generate_branch_name() {
     local description="$1"
-    
+
     # Common stop words to filter out
     local stop_words="^(i|a|an|the|to|for|of|in|on|at|by|with|from|is|are|was|were|be|been|being|have|has|had|do|does|did|will|would|should|could|can|may|might|must|shall|this|that|these|those|my|your|our|their|want|need|add|get|set)$"
-    
+
     # Convert to lowercase and split into words
     local clean_name=$(echo "$description" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/ /g')
-    
+
     # Filter words: remove stop words and words shorter than 3 chars (unless they're uppercase acronyms in original)
     local meaningful_words=()
     for word in $clean_name; do
         # Skip empty words
         [ -z "$word" ] && continue
-        
+
         # Keep words that are NOT stop words AND (length >= 3 OR are potential acronyms)
         if ! echo "$word" | grep -qiE "$stop_words"; then
             if [ ${#word} -ge 3 ]; then
@@ -159,12 +159,12 @@ generate_branch_name() {
             fi
         fi
     done
-    
+
     # If we have meaningful words, use first 3-4 of them
     if [ ${#meaningful_words[@]} -gt 0 ]; then
         local max_words=3
         if [ ${#meaningful_words[@]} -eq 4 ]; then max_words=4; fi
-        
+
         local result=""
         local count=0
         for word in "${meaningful_words[@]}"; do
@@ -220,15 +220,15 @@ if [ ${#BRANCH_NAME} -gt $MAX_BRANCH_LENGTH ]; then
     # Calculate how much we need to trim from suffix
     # Account for: feature number (3) + hyphen (1) = 4 chars
     MAX_SUFFIX_LENGTH=$((MAX_BRANCH_LENGTH - 4))
-    
+
     # Truncate suffix at word boundary if possible
     TRUNCATED_SUFFIX=$(echo "$BRANCH_SUFFIX" | cut -c1-$MAX_SUFFIX_LENGTH)
     # Remove trailing hyphen if truncation created one
     TRUNCATED_SUFFIX=$(echo "$TRUNCATED_SUFFIX" | sed 's/-$//')
-    
+
     ORIGINAL_BRANCH_NAME="$BRANCH_NAME"
     BRANCH_NAME="${FEATURE_NUM}-${TRUNCATED_SUFFIX}"
-    
+
     >&2 echo "[specify] Warning: Branch name exceeded GitHub's 244-byte limit"
     >&2 echo "[specify] Original: $ORIGINAL_BRANCH_NAME (${#ORIGINAL_BRANCH_NAME} bytes)"
     >&2 echo "[specify] Truncated to: $BRANCH_NAME (${#BRANCH_NAME} bytes)"
 
@@ -8,17 +8,17 @@ ARGS=()
 
 for arg in "$@"; do
     case "$arg" in
-        --json) 
-            JSON_MODE=true 
+        --json)
+            JSON_MODE=true
             ;;
-        --help|-h) 
+        --help|-h)
             echo "Usage: $0 [--json]"
             echo "  --json    Output results in JSON format"
             echo "  --help    Show this help message"
-            exit 0 
+            exit 0
             ;;
-        *) 
-            ARGS+=("$arg") 
+        *)
+            ARGS+=("$arg")
             ;;
     esac
 done
@@ -53,9 +53,8 @@ if $JSON_MODE; then
         "$FEATURE_SPEC" "$IMPL_PLAN" "$FEATURE_DIR" "$CURRENT_BRANCH" "$HAS_GIT"
 else
     echo "FEATURE_SPEC: $FEATURE_SPEC"
-    echo "IMPL_PLAN: $IMPL_PLAN" 
+    echo "IMPL_PLAN: $IMPL_PLAN"
     echo "SPECS_DIR: $FEATURE_DIR"
     echo "BRANCH: $CURRENT_BRANCH"
     echo "HAS_GIT: $HAS_GIT"
 fi
-
Original file line number	Diff line number	Diff line change
`@@ -82,4 +82,4 @@ Last sync check: 2025-07-16`
`82`	`82`
`83`	`83`	`---`
`84`	`84`
`85`		`-This checklist ensures the constitution's principles are consistently applied across all project documentation.`
	`85`	`+This checklist ensures the constitution's principles are consistently applied across all project documentation.`
Original file line number	Diff line number	Diff line change
`@@ -153,4 +153,3 @@ EOF`
`153`	`153`
`154`	`154`	`check_file() { [[ -f "$1" ]] && echo " ✓ $2" \|\| echo " ✗ $2"; }`
`155`	`155`	`check_dir() { [[ -d "$1" && -n $(ls -A "$1" 2>/dev/null) ]] && echo " ✓ $2" \|\| echo " ✗ $2"; }`
`156`		`-`