cleanup: drop retired login and auth schema residue #308

New issue

Closed

opened 2026-05-11 19:19:07 +00:00 by barrettruth · 0 comments

barrettruth commented

2026-05-11 19:19:07 +00:00

Owner

Parent: #305

Problem

The app login flow is gone, but the active schema and setup scripts still imply password/TOTP/WebAuthn/recovery/session infrastructure. scripts/setup.sh still asks for a password even though the seed path no longer needs app-login credentials.

Current residue

users.passwordHash, totpSecret, and totpEnabled
webauthn_credentials
recovery_codes
sessions
accounts if it is only a leftover login/OAuth table rather than the Google sync provider model
password prompts in setup/seed scripts
tests that only prove removed login behavior is hidden

Solution

Collapse auth to the current single-owner/API-key contract:

keep only the fields needed for owner identity, API key, and provider sync ownership
remove password/TOTP/WebAuthn/recovery/session schema and tests that no longer correspond to a live feature
make setup bootstrap the owner/API key without asking for dead credentials
keep Google provider OAuth separate from app authentication

Acceptance criteria

Setup no longer asks for an unused password.
Active schema no longer exports retired login tables/columns.
Auth/core tests describe the single-owner API-key behavior, not removed login flows.
Google provider OAuth issues (#290, #123, #291) still have a clear token-storage path.

Parent: #305 ## Problem The app login flow is gone, but the active schema and setup scripts still imply password/TOTP/WebAuthn/recovery/session infrastructure. `scripts/setup.sh` still asks for a password even though the seed path no longer needs app-login credentials. ## Current residue - `users.passwordHash`, `totpSecret`, and `totpEnabled` - `webauthn_credentials` - `recovery_codes` - `sessions` - `accounts` if it is only a leftover login/OAuth table rather than the Google sync provider model - password prompts in setup/seed scripts - tests that only prove removed login behavior is hidden ## Solution Collapse auth to the current single-owner/API-key contract: - keep only the fields needed for owner identity, API key, and provider sync ownership - remove password/TOTP/WebAuthn/recovery/session schema and tests that no longer correspond to a live feature - make setup bootstrap the owner/API key without asking for dead credentials - keep Google provider OAuth separate from app authentication ## Acceptance criteria - Setup no longer asks for an unused password. - Active schema no longer exports retired login tables/columns. - Auth/core tests describe the single-owner API-key behavior, not removed login flows. - Google provider OAuth issues (#290, #123, #291) still have a clear token-storage path.

barrettruth added this to the v0.1.0 milestone

2026-05-11 19:19:07 +00:00

barrettruth added the

track:core

type:cleanup

labels

2026-05-11 19:19:07 +00:00

barrettruth referenced this issue

2026-05-11 19:20:49 +00:00

tracker: blank-start cleanup and foundation migration #305

barrettruth referenced this issue from a pull request that will close it,

2026-05-11 20:22:10 +00:00