OAuth and reader tiers

Scope

Cloud docs site authentication and per-document reader access. Fact set for WING-259; no secrets, client IDs, or emails in this doc.

Sign-in: Google OAuth + PKCE

• Flow: authorization code with PKCE.
• Client does not hold a client secret.
• PKCE is configured (verified signed-out in prod, 2026-07-30).

id_token verification (WING-243)

Checks present and mutation-tested (Stryker; killed per mutant):

• Issuer check
• Audience check
• Constant-time signature/claims compare (FixedEquals)

Known gap:

• email_verified claim checks (two code paths) had NoCoverage in Stryker.
• Full coverage of those paths needs HTTP-stubbed OAuth exchange.
• Follow-up tracked in wt-cont-wing243.

Reader tiers

• Audiences are defined per document in cloud-docs-manifest.json (examples: yc-reviewer, team-test).
• Access is fail-closed: no allowlist entry → no docs.

Session allowlist snapshot (revocation trap)

• Allowlist is snapshotted at session creation.
• Revoking a user does not terminate live sessions until a re-check occurs.
• Documented in WING-222 / WING-223 / WING-224 work.

Layering

Layer	Mechanism	Role
1	Cloudflare Access (OTP)	Perimeter
2	App Google OAuth + PKCE	Application identity

Both layers are required for protected surfaces.

Environment hazard (RT-3)

• Seven reader-related settings are live-only and undeclared on the env ladder.
• A ladder deploy would strip them and reject live sessions.
• TODO(verify): exact setting names and where they are stored (do not put values here).

Production verification status (2026-07-30)

Check	Status
Signed-out: access control functional	Verified
Signed-out: PKCE configured	Verified
Signed-in end-to-end with allowlisted Google account	Deferred (needs real allowlisted account)

TODO(verify)

• Exact names of the seven reader settings (RT-3).
• Client ID location / configuration surface (path or secret store only; never paste values).