auth-isolation-check.sh43 lines · main

1	#!/usr/bin/env bash
2	# Human-assisted isolation check helper (S6.1 / Clerk gap).
3	# Does NOT create projects. Prints the exact clicks + optional API probes
4	# if you pass two project-scoped auth public keys (pk_ only — never brk_ in browser).
5	#
6	# Usage:
7	# ./scripts/auth-isolation-check.sh
8	# ./scripts/auth-isolation-check.sh p_AAA p_BBB
9	set -euo pipefail
10
11	API="${BRIVEN_API_ORIGIN:-https://api.briven.tech}"
12	A="${1:-}"
13	B="${2:-}"
14
15	cat <<EOF
16	== Auth isolation check (project A vs project B) ==
17
18	In the dashboard (you must do this — takes ~10 minutes):
19
20	1. Project A → Auth → enable (if needed) → create public key pk_… for A
21	2. Sign up a user on A's hosted auth / your pilot (e.g. you+a@email.com)
22	3. Project B → Auth → enable → create a DIFFERENT public key for B
23	4. Project B → Auth → Users
24	PASS = user from step 2 is NOT listed
25	5. (Optional) Configure a second app with B's project id + B's pk_
26	Sign up another user → appears only on B
27
28	Why this matters: Clerk multi-app isolation is assumed; we must show it.
29
30	Platform readiness (agent):
31	EOF
32
33	./scripts/s6-auth-verify.sh "$API" || true
34
35	if [[ -n "$A" && -n "$B" ]]; then
36	echo
37	echo "Optional: if you export BRIVEN_PEN_TEST_* tokens, run:"
38	echo " BRIVEN_PEN_TEST_RUN=1 BRIVEN_PEN_TEST_TENANT_A_ID=$A BRIVEN_PEN_TEST_TENANT_B_ID=$B \\"
39	echo " BRIVEN_PEN_TEST_API_ORIGIN=$API bun test apps/api/src/services/auth-tenant-isolation.test.ts"
40	fi
41
42	echo
43	echo "Record results in docs/CLERK-GAP-EVIDENCE.md and AUTH-GO-LIVE-CHECKLIST.md"