# Final fix report: user-service auth and minikube

## Status

PASS. The critical, important, and minor findings from the final review were fixed, regression-tested, built into the minikube image, deployed, and smoke-tested through the live application.

Commit: the final fix commit containing this report; its immutable SHA is recorded in the parent handoff because a Git commit cannot contain its own hash.

## Changes

- Represented the upstream PostgreSQL `bigint` user ID as a canonical positive decimal string throughout the application. Unsafe JavaScript numbers are rejected instead of rounded.
- Added one shared runtime validator for auth identities, strict UUID validation for application user/JWT IDs, and the exact supported model set.
- Adopted legacy email-matched users atomically before external-ID upsert, preserving the existing application UUID, history, and selected model.
- Rejected blank/whitespace credentials and delegated interactive login to `user-service`.
- Replaced the private MinIO redirect with an authenticated, owner-checked, same-origin streamed download. The browser now downloads with the stored Bearer token and shows a safe error on failure.
- Fixed the PostgreSQL UUID/text inference bug in pending attachment object-key generation.
- Added a 180-second startup probe window while retaining the existing readiness/liveness probes.
- Split build and production dependency installation so the runtime image contains production dependencies only.
- Updated the auth setup documentation and environment comments without staging unrelated working-tree edits.

## Files in this fix wave

- `.env.example`
- `Dockerfile`
- `README.md`
- `app/api/attachments/[id]/route.ts`
- `app/api/attachments/[id]/route.test.ts`
- `app/api/auth/login/route.ts`
- `app/api/auth/routes.test.ts`
- `components/auth/auth-gate.tsx`
- `components/auth/auth-gate.test.tsx`
- `components/auth/login-screen.tsx`
- `components/chat/chat-app.test.tsx`
- `components/chat/chat-message.tsx`
- `components/chat/chat-message.test.tsx`
- `k8s/app.yaml`
- `lib/auth/server.ts`
- `lib/auth/server.test.ts`
- `lib/auth/types.ts`
- `lib/auth/types.test.ts`
- `lib/auth/user-service.ts`
- `lib/auth/user-service.test.ts`
- `lib/db/attachments.ts`
- `lib/db/attachments-query.test.ts`
- `lib/db/users.ts`
- `lib/db/users.test.ts`
- `lib/storage/s3.ts`

## Red/green evidence

- Auth regression tests first failed in 6 of 7 files with 20 expected failures for numeric IDs, permissive identities, non-UUID subjects, and legacy-user replacement. After the changes: 7 files, 57 tests passed.
- Attachment tests first showed the private redirect (`302` instead of `200`) and no authenticated download control. After the changes: route/component coverage passed (2 files, 5 tests).
- The live upload first returned `503`; PostgreSQL reported ambiguous and then inconsistent `$1` types. A focused regression test was added and failed before the final explicit UUID/text casts. After the fix: 3 focused attachment files, 6 tests passed, and live upload/download passed.
- The startup-probe semantic check initially returned false/exit 1 and passed after the manifest change.

## Final verification

- `npm test`: 22 files, 117 tests passed.
- `npm run lint`: passed.
- `npx tsc --noEmit`: passed.
- Next.js production build: passed in the final minikube image build.
- `kubectl apply --dry-run=client -f k8s/`: passed for all 10 objects.
- Final image: `sha256:ce32811723087cc756e722c3b5d73b1f35d2257fa83be7e74f263c7000ce424a`.
- Deployment: 1 desired, 1 updated, 1 ready, 1 available replica.
- Stack: UI, MinIO, PostgreSQL, user-service, and user-service PostgreSQL all `Running`/`Ready`, with zero restarts.
- Runtime package check: AWS SDK and `pg` are present; `eslint` is absent.

## Live smoke test

All requests used bounded timeouts, and no password or token was printed or written to the report.

- Login through `user-service`: HTTP 200.
- Authenticated `/api/auth/me`: HTTP 200; `externalUserId` is a string at runtime.
- Attachment upload: HTTP 201.
- Authenticated same-origin attachment download: HTTP 200.
- Downloaded 5,964 bytes and matched the uploaded file byte-for-byte.
- Safe profile fields observed: `Test Admin`, `Administrator`, role `admin`, model `chatgpt`.
- The workstation-local port-forward remains active on `http://localhost:3000` (PID 48069 at verification time).

## Security and residual concerns

- JWT subjects are rejected before database access unless they are UUIDs; ownership is checked before object storage access; no cluster-internal MinIO URL reaches the browser.
- Responses use `Cache-Control: no-store`, safe attachment disposition encoding, and `X-Content-Type-Options: nosniff`.
- `npm audit --omit=dev` reports 5 production dependency findings (2 moderate, 3 high). Broad dependency upgrades were intentionally not mixed into this fix wave and need separate triage with regression testing.
- The current upstream JSON contract emits the external ID as a number. IDs beyond JavaScript's safe-integer range are deliberately rejected; full signed-`bigint` support requires `user-service` to emit the ID as a decimal string.
- The smoke upload creates a pending attachment governed by the existing 24-hour expiry policy.