# 09 — Production dev-login removal gate

## Goal

Before the first production deployment, verify that development-only login/test shortcuts cannot be enabled accidentally in production.

## Depends on

- 06
- 07
- local dev-login setup in `docs/dev-login.md`

## Scope

- Review all production env sources:
  - `.env.production.example`
  - `deploy/compose.yaml`
  - any host-level Docker Compose override files
  - deployment secrets on the server
- Confirm production does not set:
  - `ENABLE_DEV_LOGIN=true`
  - `DEV_LOGIN_EMAIL`
  - `DEV_LOGIN_NAME`
  - `DEV_HOUSEHOLD_NAME`
- Confirm production Authentik variables are real:
  - `AUTH_OIDC_ISSUER`
  - `AUTH_OIDC_CLIENT_ID`
  - `AUTH_OIDC_CLIENT_SECRET`
- Build with production-like env and verify `/login` renders only the SSO login path.
- Verify the app still protects private routes without a valid Auth.js session cookie.
- Verify real Authentik login creates the expected user, household membership, default calendars, and default lists.
- Remove any accidental dev users from the production database.

## Optional hardening

- Remove `src/lib/dev-login.ts` and the Dev login form from `src/app/login/page.tsx` entirely before first production deployment.
- If retaining the code for future local development, keep the current double gate:
  - `NODE_ENV !== "production"`
  - `ENABLE_DEV_LOGIN=true`

## Acceptance criteria

- [ ] Production env cannot enable Dev login accidentally.
- [ ] `/login` in production does not show **Dev login**.
- [ ] Direct dev-login action execution is unavailable in production.
- [ ] Real Authentik login works on the production domain.
- [ ] No `dev@famapp.local` or configured dev-login user exists in production data.