# Bilko Mobile Phase 0 Auth Bridge — Status 2026-06-05

null

---

## Update 2026-07-10 — T1 CIAM mobile app provisioning COMPLETE (MC #105193)

- **Canonical mobile app registration:** `916bb9f3-658d-4729-b5a0-64b1f157c8c2` "Bilko Mobile (Native)" — single-tenant (`AzureADMyOrg`), public client, PKCE, redirects `com.alai.bilko://auth` + `msauth.com.alai.bilko://auth`.
- Stray duplicate `31d2eb67` (invalid `AzureADandPersonalMicrosoftAccount` audience for CIAM, no API perms) deleted 2026-07-10.
- **Admin consent verified** (Graph oauth2PermissionGrants, `AllPrincipals`): bilko-api `access_as_user` + Graph `openid profile offline_access email User.Read`.
- `apps/mobile/eas.json`: client ID wired in all 3 build profiles; `EXPO_PUBLIC_API_URL` on Azure stage FQDN. PR 90 squash-merged to main (`1cd39b59`); `ENTRA_SCOPES` now includes `api://fe39e0f5-513e-40af-93f0-c3ee624df56c/access_as_user`, `usePKCE: true`.
- Securion (Parisa) S3: PASS-WITH-FINDINGS; **F1 open** → live decoded access token must carry `oid` + email claim — verified in T3 MC #105194 (EAS build + live CIAM login).
- P2P peer pre-verify (Proveo native agent): PASS 7/7. Evidence: `~/system/evidence/105193/`.
- Live probes 2026-07-10: stage API `GET /api/v1/health` = 200; CIAM OIDC discovery = 200 (authorize/token endpoints resolve).

## Update 2026-07-10 (kasno) — T3 validacija PASS (MC #105194)

- **EAS buildovi:** Android preview APK `b0ad45d8` FINISHED (remote keystore, PR 91); iOS simulator `0daaa883` + `0bd02a4c` FINISHED.
- **Demo mode bug nađen i fixan** (MC #105220): `normalizeMobileSession` je tražio refreshToken koji `/auth/demo` ne vraća — demo login na mobilnom nikad nije radio. Fix PR 92 (`005ec745`), validiran punim Maestro flow-om (country→login→demo→Dashboard→Troškovi, 12/12).
- **Parisa F1 PASS:** pravi ciamlogin.com programatski login → access token `aud=bilko-api`, `scp=access_as_user`, `oid` prisutan; stage auth bridge `POST /auth/entra/session` → 200 s mapiranim user/org.
- **Maestro** usvojen kao mobile UI regression harness — flowovi u `~/system/evidence/105194/maestro/`.
- Preostalo za Phase 1 ship: App Store Connect (#103242, čeka CEO ASC pristup) + TestFlight/interna distribucija.

## 🏁 2026-07-11 — PHASE 1 SHIPPED: TestFlight build 19 + Android APK (MC #105192)

- **ASC bloker riješen** (#103242): root cause = nepotpisan Apple Developer ugovor (`REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED`), NE build problem. CEO potpisao 2026-07-11. ASC API key `VR5HY83A65` u Bitwardenu ("ASC API Key — Basic AS") → ASC operacije od sada bez CEO logina. ⚠️ Rotirati key (prošao kroz chat transkript).
- **TestFlight build 19**: production EAS build `d231817b` s main `005ec745` (CIAM client ID 916bb9f3 + demo-session fix) → `eas submit` (ASC API key) → `VALID`, `IN_BETA_TESTING`. Prvi build s radnim Microsoft loginom i demo modom.
- **Android preview APK**: build `b0ad45d8`, EAS remote keystore, artifact HTTP 200.
- Svi MC taskovi (#105192/93/94, #105220, #103242) ready_for_review s nezavisnim peer verdiktima.
- **Napomena za TestFlight**: buildovi ≤18 imaju placeholder client ID — Entra login radi tek od builda 19.