A rollout preview: walk the product as any role, in a tenant of its own

.github/workflows/master-preview-access.yml

@@ -34,13 +34,22 @@ name: Master preview access
 #                                         (FORCE_CHANGE_PASSWORD →
 #                                         challenge-required, refused)
 #   2. seed the preview world           ← the slow, fallible part
-#   3. set the permanent password       ← the only step that ARMS sign-in
+#   3. set the permanent password       ← the last step that can arm sign-in
 #
 # So a run killed anywhere — including by this job's own timeout — leaves an
 # account that cannot sign in, never one that signs in to an empty world. The
 # reverse order would make a half-finished run look like "the data is gone",
 # which is precisely the impression a preview exists to prevent.
 #
+# The password is necessary and NOT sufficient, and step 2 is what enforces
+# that. `MASTER_ACCESS_EMAILS` on the running service is the door the preview
+# account is admitted through (ADR-0020 §2); the seeder writes no
+# `RestrictedIdentity` and no seal row, so with the variable unset the address
+# is refused at sign-in exactly like any address the Simon roster has never
+# heard of. Rather than seed a world nobody can open, the seeder REFUSES when
+# the `--email` it is given is not on that allowlist — which fails this job
+# BEFORE step 3, leaving no password behind.
+#
 # ── This workflow prints a password into the run summary ────────────────────
 #
 # That is deliberate and it is the thing the user asked for. The tradeoff is
@@ -106,7 +115,16 @@ jobs:
       # membership (lib/tenant-scope.ts resolveTenantScope), so a membership in
       # this institution — and ONLY this one — is what keeps the preview off the
       # real cohort's rows in both directions.
-      PREVIEW_SLUG: simon-ose-preview
+      #
+      # Renamed from `simon-ose-preview` on merging the rollout-preview boundary
+      # and chooser (#129), which seeds this same tenant and names it from
+      # `apps/web/src/lib/preview/personas.ts`. Two preview tenants would have
+      # been the defect. The name moved THIS way because `fork-prevention.test.ts`
+      # fails any new file under `src` carrying a `simon` literal and holds its
+      # allowance total equal to a ceiling, so the app cannot spell the old name
+      # without an exemption that gate is built to refuse — measured, not assumed.
+      # This file is outside `src` and may name whatever it points at.
+      PREVIEW_SLUG: tenure-rollout-preview
 
       # The entrypoint mode that seeds the preview tenant. Must match a dispatch
       # in apps/web/scripts/entrypoint.sh EXACTLY; an unmatched mode now exits 64
@@ -573,10 +591,24 @@ jobs:
             echo "| tenant | \`$PREVIEW_SLUG\` — synthetic, seeded for this account |"
             echo "| Cognito pool | \`$POOL_ID\` |"
             echo ""
-            echo "This account holds membership in \`$PREVIEW_SLUG\` and nowhere else, so every"
-            echo "query it makes is scoped there by the ordinary tenancy mechanism. It cannot"
+            echo "This account holds NO membership and NO seat of its own. It signs in and lands"
+            echo "on the role chooser at \`/preview\`, and everything it can see it sees THROUGH a"
+            echo "persona whose memberships and seats are in \`$PREVIEW_SLUG\` and nowhere else — so"
+            echo "every query it makes is scoped there by the ordinary tenancy mechanism. It cannot"
             echo "read the Simon cohort's rows and the Simon cohort cannot read its rows."
             echo "Every screen is the real screen, rendered through the real authorization path."
+            echo ""
+            echo "### One thing this workflow cannot do for you"
+            echo ""
+            echo "\`MASTER_ACCESS_EMAILS\` must contain \`$PREVIEW_EMAIL\` **on the running service**."
+            echo "That variable is the door (ADR-0020 §2): the seeder writes no \`RestrictedIdentity\`"
+            echo "and no seal row, deliberately, so with the variable unset this account is refused"
+            echo "at sign-in like any address the Simon roster has never heard of. It is a change to"
+            echo "\`environment\` in \`infrastructure/terraform/ecs.tf\` followed by a rollout — a"
+            echo "deployment decision on purpose, and the reason \`/preview\` does not exist by"
+            echo "default. The seed step above REFUSES rather than reporting success when the"
+            echo "address it was given is not on that allowlist, so a green run means the door is"
+            echo "already open."
           } >> "$GITHUB_STEP_SUMMARY"
 
           echo "::notice title=Preview account ready::The password is in this run's summary."

apps/web/.env.example

@@ -142,6 +142,31 @@ EDGE_HOST_SECRET=
 # Skip the migration bootstrap entirely (scripts/db-bootstrap.mjs).
 # SKIP_DB_BOOTSTRAP=true
 
+# ── The rollout preview ───────────────────────────────────────────────────────
+
+# Addresses that may walk the product as any role, to see what the pilot's users
+# will see. Comma-separated, and OFF in every deployment.
+#
+# Unset, empty and whitespace are the same answer: the feature does not exist.
+# /preview 404s for everybody, the eligibility branch is unreachable, and no
+# session carries a preview field — a deployment that never sets this is
+# indistinguishable from one where none of it was built. That is why it is a
+# deployment decision and not a database row; see ADR-0019.
+#
+# The address does NOT need to be on the restricted roster, and is deliberately
+# not put on it: it is admitted through a separate door that never reads the
+# registry and never writes to it. Every admission logs loudly.
+#
+# Which also means this variable is NOT optional for the preview to work. The
+# seeder writes no RestrictedIdentity row, so with this unset the address is
+# refused at sign-in like any other stranger — including by
+# .github/workflows/master-preview-access.yml, whose seed step refuses rather
+# than leaving a password behind for an account the gate will turn away.
+#
+# Build the world it previews with:
+#   MASTER_ACCESS_EMAILS=… node scripts/seed-preview-world.mjs
+# MASTER_ACCESS_EMAILS=
+
 # ── Tenant configuration packs ────────────────────────────────────────────────
 
 # Where to read this tenant's configuration packs from — the institutional

apps/web/e2e/preview-disabled.spec.ts

@@ -0,0 +1,71 @@
+import { expect, test } from "@playwright/test"
+
+/**
+ * The deployment where MASTER_ACCESS_EMAILS is not set.
+ *
+ * This is the pilot's configuration, and the requirement is stronger than "the
+ * preview is off": it must be indistinguishable from a build where none of this
+ * was written. The unit tests prove the branch is unreachable; this proves the
+ * SERVER agrees, which is the only version of the claim that survives somebody
+ * typing the URL.
+ *
+ * Run against a server started WITHOUT the variable:
+ *
+ *   PREVIEW_EXPECT_DISABLED=1 npx playwright test e2e/preview-disabled.spec.ts
+ */
+
+test.skip(
+  process.env.PREVIEW_EXPECT_DISABLED !== "1",
+  "Only meaningful against a server started with MASTER_ACCESS_EMAILS unset.",
+)
+
+const PREVIEW_ADDRESS = "satvik@tenurework.com"
+
+test.describe("with the allowlist unset", () => {
+  test("the chooser route does not exist for anybody", async ({ page }) => {
+    // Signed in as the real tenant's Director — the widest-privileged account
+    // there is. Even they get a 404, because the route is not gated on a role;
+    // it is gated on a deployment decision that was not taken.
+    await page.context().clearCookies()
+    await page.goto("/signin")
+    const form = page.getByRole("region", { name: "Pilot access" })
+    await form.getByLabel("Email address").fill("director@tenure.demo")
+    const passphrase = process.env.DEV_LOGIN_PASSPHRASE
+    if (passphrase) await form.getByLabel("Access passphrase").fill(passphrase)
+    await form.getByRole("button", { name: "Sign in" }).click()
+    // Wherever their WORKSPACE puts them, which for this account is `/admin`.
+    // This waited for `/dashboard` and hung for the full timeout: ADR-0019 makes
+    // the landing path a function of role, and an OSE Director's is the console
+    // — `/signin` sends them to `/workspace`, which redirects. `preview.spec.ts`
+    // in this same change already encodes that (`"OSE Director": /\/admin/`),
+    // so the two specs disagreed about the product and only one of them ran.
+    //
+    // Left as an alternation rather than pinned to `/admin`, because the landing
+    // is not what is being tested here: the assertion is the 404 below, and this
+    // line only has to establish that the widest-privileged account is signed in
+    // before it asks for the route.
+    await page.waitForURL(/\/admin|\/dashboard|\/orgs/)
+
+    const response = await page.goto("/preview")
+    expect(response?.status()).toBe(404)
+  })
+
+  test("the preview address has no standing of its own", async ({ page }) => {
+    await page.context().clearCookies()
+    await page.goto("/signin")
+    const form = page.getByRole("region", { name: "Pilot access" })
+    await form.getByLabel("Email address").fill(PREVIEW_ADDRESS)
+    const passphrase = process.env.DEV_LOGIN_PASSPHRASE
+    if (passphrase) await form.getByLabel("Access passphrase").fill(passphrase)
+    await form.getByRole("button", { name: "Sign in" }).click()
+
+    // It is an ordinary account holding no membership and no seat, so the
+    // entitlement gate in `(app)/layout.tsx` sends it where it sends anybody
+    // else in that state. No chooser, no persona, no badge.
+    await page.waitForURL(/\/access-pending|\/signin/)
+    expect(page.url()).not.toContain("/preview")
+    expect(page.url()).not.toContain("/dashboard")
+    await page.setViewportSize({ width: 1280, height: 800 })
+    await page.screenshot({ path: "test-results/preview-18-disabled-no-standing.png" })
+  })
+})