famapp/docs/tasks/09-production-dev-login-removal.md

09 — Production dev-login removal gate

Goal

Before the first production deployment, verify that development-only login/test shortcuts cannot be enabled accidentally in production.

Depends on

• 06
• 07
• local dev-login setup in docs/dev-login.md

Scope

• Review all production env sources:
  • .env.production.example
  • deploy/compose.yaml
  • any host-level Docker Compose override files
  • deployment secrets on the server
• Confirm production does not set:
  • ENABLE_DEV_LOGIN=true
  • DEV_LOGIN_EMAIL
  • DEV_LOGIN_NAME
  • DEV_HOUSEHOLD_NAME
• Confirm production Authentik variables are real:
  • AUTH_OIDC_ISSUER
  • AUTH_OIDC_CLIENT_ID
  • AUTH_OIDC_CLIENT_SECRET
• Build with production-like env and verify /login renders only the SSO login path.
• Verify the app still protects private routes without a valid Auth.js session cookie.
• Verify real Authentik login creates the expected user, household membership, default calendars, and default lists.
• Remove any accidental dev users from the production database.

Optional hardening

• Remove src/lib/dev-login.ts and the Dev login form from src/app/login/page.tsx entirely before first production deployment.
• If retaining the code for future local development, keep the current double gate:
  • NODE_ENV !== "production"
  • ENABLE_DEV_LOGIN=true

Acceptance criteria

• Production env cannot enable Dev login accidentally.
• /login in production does not show Dev login.
• Direct dev-login action execution is unavailable in production.
• Real Authentik login works on the production domain.
• No dev@famapp.local or configured dev-login user exists in production data.