Portal access
Sign in
Production authentication is not fully wired in Phase 3. This page documents the access boundary and provides local-only mock personas when explicitly enabled for development.
Production path
The production portal will use an OAuth/OIDC or FastAPI-issued session strategy, then load user, membership, role, and organization context from Neon.
- OAuth provider identity and MFA policy are separate from app authorization.
- Application routes still check organization membership and role permissions.
- Admin surfaces should also be protected by Cloudflare Access where appropriate.
Current auth mode
Set RBA_AUTH_MODE=mock for local development or configure a future external provider.
- Requested
- disabled
- Effective
- disabled
- Configured
- No
Access closed
Protected client and admin routes fail closed until a supported auth mode is configured. For local route testing, set RBA_AUTH_MODE=mock or PUBLIC_RBA_AUTH_MODE=mock in a local environment file.
No production OAuth provider, session issuer, or FastAPI validation service has been connected in this phase.