Bilko Mobile Phase 0 Auth Bridge — Status 2026-06-05

null

Update 2026-07-10 — T1 CIAM mobile app provisioning COMPLETE (MC #105193)

Canonical mobile app registration: 916bb9f3-658d-4729-b5a0-64b1f157c8c2 "Bilko Mobile (Native)" — single-tenant (AzureADMyOrg), public client, PKCE, redirects com.alai.bilko://auth + msauth.com.alai.bilko://auth.
Stray duplicate 31d2eb67 (invalid AzureADandPersonalMicrosoftAccount audience for CIAM, no API perms) deleted 2026-07-10.
Admin consent verified (Graph oauth2PermissionGrants, AllPrincipals): bilko-api access_as_user + Graph openid profile offline_access email User.Read.
apps/mobile/eas.json: client ID wired in all 3 build profiles; EXPO_PUBLIC_API_URL on Azure stage FQDN. PR 90 squash-merged to main (1cd39b59); ENTRA_SCOPES now includes api://fe39e0f5-513e-40af-93f0-c3ee624df56c/access_as_user, usePKCE: true.
Securion (Parisa) S3: PASS-WITH-FINDINGS; F1 open → live decoded access token must carry oid + email claim — verified in T3 MC #105194 (EAS build + live CIAM login).
P2P peer pre-verify (Proveo native agent): PASS 7/7. Evidence: ~/system/evidence/105193/.
Live probes 2026-07-10: stage API GET /api/v1/health = 200; CIAM OIDC discovery = 200 (authorize/token endpoints resolve).

EAS buildovi: Android preview APK b0ad45d8 FINISHED (remote keystore, PR 91); iOS simulator 0daaa883 + 0bd02a4c FINISHED.
Demo mode bug nađen i fixan (MC #105220): normalizeMobileSession je tražio refreshToken koji /auth/demo ne vraća — demo login na mobilnom nikad nije radio. Fix PR 92 (005ec745), validiran punim Maestro flow-om (country→login→demo→Dashboard→Troškovi, 12/12).
Parisa F1 PASS: pravi ciamlogin.com programatski login → access token aud=bilko-api, scp=access_as_user, oid prisutan; stage auth bridge POST /auth/entra/session → 200 s mapiranim user/org.
Maestro usvojen kao mobile UI regression harness — flowovi u ~/system/evidence/105194/maestro/.
Preostalo za Phase 1 ship: App Store Connect (#103242, čeka CEO ASC pristup) + TestFlight/interna distribucija.

ASC bloker riješen (#103242): root cause = nepotpisan Apple Developer ugovor (REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED), NE build problem. CEO potpisao 2026-07-11. ASC API key VR5HY83A65 u Bitwardenu ("ASC API Key — Basic AS") → ASC operacije od sada bez CEO logina. ⚠️ Rotirati key (prošao kroz chat transkript).
TestFlight build 19: production EAS build d231817b s main 005ec745 (CIAM client ID 916bb9f3 + demo-session fix) → eas submit (ASC API key) → VALID, IN_BETA_TESTING. Prvi build s radnim Microsoft loginom i demo modom.
Android preview APK: build b0ad45d8, EAS remote keystore, artifact HTTP 200.
Svi MC taskovi (#105192/93/94, #105220, #103242) ready_for_review s nezavisnim peer verdiktima.
Napomena za TestFlight: buildovi ≤18 imaju placeholder client ID — Entra login radi tek od builda 19.