SESSION-RESUME-2026-07-27-AUTH.md158 lines · main

1	# Session resume — Auth / mavi / handoffs
2
3	Saved: 2026-07-27 (end of session)
4	Workspace: Briven platform + mavi pay (+ Pando handoffs)
5	Owner: flndrn
6
7	Start here next time. Read this file first, then continue.
8
9	---
10
11	## One-line status
12
13	Mavi pay production login works: magic link · email OTP · Konnos OAuth.
14	Paused on purpose: passkeys retest · SMS/Twilio (US address / compliance).
15	Do not claim 100% SuperTokens — overall ~80–85% surface, ~90%+ day-to-day login.
16
17	---
18
19	## Projects & IDs
20
21	\| Project \| Path \| Notes \|
22	\|---------\|------\|--------\|
23	\| Briven platform \| `/Users/flndrn/Desktop/briven` \| Auth engine; France `187.124.64.116` compose `briven-brivenfrance-uilsk6` \|
24	\| Mavi pay \| `/Users/flndrn/Desktop/mavi-pay` \| Live `https://pay.mavifinans.sh` · Briven project `p_01KWQ37MSQPAZNQCTESBV370NM` \|
25	\| Pando \| `/Users/flndrn/Desktop/pando` \| Project `p_01KWF6KB8G7AT5TE016BYX1X19` · Auth still stub in app \|
26
27	---
28
29	## Guided test scoreboard (the “6”)
30
31	\| Step \| Topic \| Status \|
32	\|------\|--------\|--------\|
33	\| 1–3 \| Setup / ready \| Done earlier \|
34	\| 4 \| Magic link · email code · Konnos \| PASS (user proved) \|
35	\| 5 \| Passkeys \| PAUSED — first-time UX improved; full enroll→signin retest not closed \|
36	\| 6 \| SMS / Twilio \| PAUSED — US number `+19382533203`; needs US address / A2P path or different provider later \|
37
38	Use in production without 5–6: magic + email OTP + Konnos.
39
40	---
41
42	## What shipped this arc (high level)
43
44	### Briven
45	- Konnos OAuth → `konnos.org` (not code.konnos.org)
46	- Passwordless emails: project brand name, magic-link button, OTP without extra magic link
47	- Auth emails: Platform / device location / time (Europe/Brussels)
48	- Passkey rpId from app host (`pay.mavifinans.sh`), not hard-coded `briven.tech`
49	- M2M handoff for all projects
50	- Soft-disable, providers revoke, etc. from earlier in chain
51
52	### Konnos (product OAuth)
53	- Empty `code_challenge` no longer breaks token exchange (PKCE false fail)
54
55	### Mavi
56	- First-party FDI proxy, Konnos callback `/auth/callback`
57	- Transparent Konnos logo
58	- Passkey first-time copy + post-login “Add passkey” prompt (deployed; retest open)
59
60	### Docs / handoffs
61	\| Doc \| Path \|
62	\|-----\|------\|
63	\| This resume \| `docs/SESSION-RESUME-2026-07-27-AUTH.md` \|
64	\| SuperTokens parity matrix \| `docs/AUTH-SUPERTOKENS-PARITY-MATRIX.md` \|
65	\| M2M all projects \| `docs/HANDOFF-AUTH-M2M-FOR-ALL-PROJECTS.md` \|
66	\| Auth for any app \| `docs/HANDOFF-AUTH-FOR-OTHER-PROJECTS.md` \|
67	\| Pando Auth handoff \| `/Users/flndrn/Desktop/pando/docs/HANDOFF-BRIVEN-AUTH-FOR-PANDO.md` \|
68	\| Pando M2M pointer \| `/Users/flndrn/Desktop/pando/docs/HANDOFF-BRIVEN-M2M.md` \|
69	\| SMS Twilio checklist \| `docs/SMS-TWILIO-LIVE-PROVE.md` \|
70	\| SuperTokens KB rule \| `docs/knowledge-base.md` + root `CLAUDE.md` \|
71
72	---
73
74	## Parity snapshot (Briven vs SuperTokens)
75
76	\| Band \| ~% \|
77	\|------\|-----\|
78	\| Day-to-day SaaS login \| ~90–95% \|
79	\| Full ST-style surface \| ~80–85% \|
80	\| Official “100% SuperTokens” claim \| Not claimed \|
81
82	Main gaps: SMS live ops · IdP human E2E · migration polish · framework pack breadth · captcha · passkey enroll retest.
83
84	---
85
86	## Twilio / SMS (parked facts)
87
88	- Account has US From candidate: `+19382533203`
89	- SID + Auth Token were provided in past sessions (may need rotate if leaked in chat)
90	- Virtual Phone ≠ From number
91	- BE business mobile needs company registration number (user does not have) — abandoned for now
92	- Cyprus number not available on Twilio for user
93	- US path asks for US address / A2P — user chose to leave SMS as-is
94
95	---
96
97	## Passkeys (parked facts)
98
99	- SuperTokens model: register while signed in, then sign in with passkey
100	- Browser “no passkeys for pay.mavifinans.sh” = none stored for that rpId yet (or enroll didn’t finish as WebAuthn)
101	- User screenshot of password manager password ≠ WebAuthn passkey
102	- Doltgres: `ADD COLUMN IF NOT EXISTS` fails for webauthn rp columns (fallback insert works; schema polish open)
103
104	---
105
106	## Git state at save (approx)
107
108	\| Repo \| Note \|
109	\|------\|------\|
110	\| briven \| Often ahead of origin (push may 403 without token) \|
111	\| mavi-pay \| Main pushed for auth fixes in this arc \|
112	\| pando \| Handoffs may need commit + push; other WIP may exist on disk \|
113
114	---
115
116	## Next session options (pick one)
117
118	### A. Resume Auth polish (Briven session)
119	1. Passkey: prove Add passkey → sign out → Continue with passkey
120	2. Or SMS when Twilio address/compliance ready
121	3. Or IdP human E2E / parity gap sprint
122
123	### B. Pando (Pando session only)
124	- Read `pando/docs/HANDOFF-BRIVEN-AUTH-FOR-PANDO.md`
125	- Wire real Briven Auth (replace login stub)
126	- Never edit briven monorepo from Pando session
127
128	### C. Product work elsewhere
129	- Mavi product features with Auth as-is
130	- M2M for servers: `docs/HANDOFF-AUTH-M2M-FOR-ALL-PROJECTS.md`
131
132	---
133
134	## Copy-paste prompt for next Briven session
135
136	```
137	Resume Briven Auth work from docs/SESSION-RESUME-2026-07-27-AUTH.md
138
139	Status: mavi magic link + email OTP + Konnos PASS live.
140	Paused: passkeys retest, SMS/Twilio (US +19382533203, address/compliance).
141	Do not claim 100% SuperTokens. Knowledge-base hard rule for Auth.
142
143	Next: [user fills: passkeys \| SMS \| IdP \| Pando handoff only \| other]
144	```
145
146	---
147
148	## Hard rules (still)
149
150	1. SuperTokens docs = checklist; no Core on Doltgres.
151	2. Before Auth code changes: open `docs/knowledge-base.md` + matching ST section.
152	3. Only Briven sessions edit `/Users/flndrn/Desktop/briven` or France Auth deploys.
153	4. No Clerk/Firebase side auth for product login.
154	5. No secrets in `NEXT_PUBLIC_*` / git.
155
156	---
157
158	End of resume. Safe to close the terminal.

Preview

Session resume — Auth / mavi / handoffs

Saved: 2026-07-27 (end of session)
Workspace: Briven platform + mavi pay (+ Pando handoffs)
Owner: flndrn

Start here next time. Read this file first, then continue.

One-line status

Mavi pay production login works: magic link · email OTP · Konnos OAuth.
Paused on purpose: passkeys retest · SMS/Twilio (US address / compliance).
Do not claim 100% SuperTokens — overall ~80–85% surface, ~90%+ day-to-day login.

Projects & IDs

Project	Path	Notes
Briven platform	`/Users/flndrn/Desktop/briven`	Auth engine; France `187.124.64.116` compose `briven-brivenfrance-uilsk6`
Mavi pay	`/Users/flndrn/Desktop/mavi-pay`	Live `https://pay.mavifinans.sh` · Briven project `p_01KWQ37MSQPAZNQCTESBV370NM`
Pando	`/Users/flndrn/Desktop/pando`	Project `p_01KWF6KB8G7AT5TE016BYX1X19` · Auth still stub in app

Guided test scoreboard (the “6”)

Step	Topic	Status
1–3	Setup / ready	Done earlier
4	Magic link · email code · Konnos	PASS (user proved)
5	Passkeys	PAUSED — first-time UX improved; full enroll→signin retest not closed
6	SMS / Twilio	PAUSED — US number `+19382533203`; needs US address / A2P path or different provider later

Use in production without 5–6: magic + email OTP + Konnos.

What shipped this arc (high level)

Briven

Konnos OAuth → konnos.org (not code.konnos.org)
Passwordless emails: project brand name, magic-link button, OTP without extra magic link
Auth emails: Platform / device location / time (Europe/Brussels)
Passkey rpId from app host (pay.mavifinans.sh), not hard-coded briven.tech
M2M handoff for all projects
Soft-disable, providers revoke, etc. from earlier in chain

Konnos (product OAuth)

Empty code_challenge no longer breaks token exchange (PKCE false fail)

Mavi

First-party FDI proxy, Konnos callback /auth/callback
Transparent Konnos logo
Passkey first-time copy + post-login “Add passkey” prompt (deployed; retest open)

Docs / handoffs

Doc	Path
This resume	`docs/SESSION-RESUME-2026-07-27-AUTH.md`
SuperTokens parity matrix	`docs/AUTH-SUPERTOKENS-PARITY-MATRIX.md`
M2M all projects	`docs/HANDOFF-AUTH-M2M-FOR-ALL-PROJECTS.md`
Auth for any app	`docs/HANDOFF-AUTH-FOR-OTHER-PROJECTS.md`
Pando Auth handoff	`/Users/flndrn/Desktop/pando/docs/HANDOFF-BRIVEN-AUTH-FOR-PANDO.md`
Pando M2M pointer	`/Users/flndrn/Desktop/pando/docs/HANDOFF-BRIVEN-M2M.md`
SMS Twilio checklist	`docs/SMS-TWILIO-LIVE-PROVE.md`
SuperTokens KB rule	`docs/knowledge-base.md` + root `CLAUDE.md`

Parity snapshot (Briven vs SuperTokens)

Band	~%
Day-to-day SaaS login	~90–95%
Full ST-style surface	~80–85%
Official “100% SuperTokens” claim	Not claimed

Main gaps: SMS live ops · IdP human E2E · migration polish · framework pack breadth · captcha · passkey enroll retest.

Twilio / SMS (parked facts)

Account has US From candidate: +19382533203
SID + Auth Token were provided in past sessions (may need rotate if leaked in chat)
Virtual Phone ≠ From number
BE business mobile needs company registration number (user does not have) — abandoned for now
Cyprus number not available on Twilio for user
US path asks for US address / A2P — user chose to leave SMS as-is

Passkeys (parked facts)

SuperTokens model: register while signed in, then sign in with passkey
Browser “no passkeys for pay.mavifinans.sh” = none stored for that rpId yet (or enroll didn’t finish as WebAuthn)
User screenshot of password manager password ≠ WebAuthn passkey
Doltgres: ADD COLUMN IF NOT EXISTS fails for webauthn rp columns (fallback insert works; schema polish open)

Git state at save (approx)

Repo	Note
briven	Often ahead of origin (push may 403 without token)
mavi-pay	Main pushed for auth fixes in this arc
pando	Handoffs may need commit + push; other WIP may exist on disk

Next session options (pick one)

A. Resume Auth polish (Briven session)

Passkey: prove Add passkey → sign out → Continue with passkey
Or SMS when Twilio address/compliance ready
Or IdP human E2E / parity gap sprint

B. Pando (Pando session only)

Read pando/docs/HANDOFF-BRIVEN-AUTH-FOR-PANDO.md
Wire real Briven Auth (replace login stub)
Never edit briven monorepo from Pando session

C. Product work elsewhere

Mavi product features with Auth as-is
M2M for servers: docs/HANDOFF-AUTH-M2M-FOR-ALL-PROJECTS.md

Copy-paste prompt for next Briven session

Resume Briven Auth work from docs/SESSION-RESUME-2026-07-27-AUTH.md

Status: mavi magic link + email OTP + Konnos PASS live.
Paused: passkeys retest, SMS/Twilio (US +19382533203, address/compliance).
Do not claim 100% SuperTokens. Knowledge-base hard rule for Auth.

Next: [user fills: passkeys | SMS | IdP | Pando handoff only | other]

Hard rules (still)

SuperTokens docs = checklist; no Core on Doltgres.
Before Auth code changes: open docs/knowledge-base.md + matching ST section.
Only Briven sessions edit /Users/flndrn/Desktop/briven or France Auth deploys.
No Clerk/Firebase side auth for product login.
No secrets in NEXT_PUBLIC_* / git.

End of resume. Safe to close the terminal.