Bilko Mobile Phase 0 Auth Bridge — Status 2026-06-05

null 
 
 Update 2026-07-10 — T1 CIAM mobile app provisioning COMPLETE (MC #105193) 
 
 Canonical mobile app registration: 916bb9f3-658d-4729-b5a0-64b1f157c8c2 "Bilko Mobile (Native)" — single-tenant ( AzureADMyOrg ), public client, PKCE, redirects com.alai.bilko://auth + msauth.com.alai.bilko://auth . 
 Stray duplicate 31d2eb67 (invalid AzureADandPersonalMicrosoftAccount audience for CIAM, no API perms) deleted 2026-07-10. 
 Admin consent verified (Graph oauth2PermissionGrants, AllPrincipals ): bilko-api access_as_user + Graph openid profile offline_access email User.Read . 
 apps/mobile/eas.json : client ID wired in all 3 build profiles; EXPO_PUBLIC_API_URL on Azure stage FQDN. PR 90 squash-merged to main ( 1cd39b59 ); ENTRA_SCOPES now includes api://fe39e0f5-513e-40af-93f0-c3ee624df56c/access_as_user , usePKCE: true . 
 Securion (Parisa) S3: PASS-WITH-FINDINGS; F1 open → live decoded access token must carry oid + email claim — verified in T3 MC #105194 (EAS build + live CIAM login). 
 P2P peer pre-verify (Proveo native agent): PASS 7/7. Evidence: ~/system/evidence/105193/ . 
 Live probes 2026-07-10: stage API GET /api/v1/health = 200; CIAM OIDC discovery = 200 (authorize/token endpoints resolve). 
 
 Update 2026-07-10 (kasno) — T3 validacija PASS (MC #105194) 
 
 EAS buildovi: Android preview APK b0ad45d8 FINISHED (remote keystore, PR 91); iOS simulator 0daaa883 + 0bd02a4c FINISHED. 
 Demo mode bug nađen i fixan (MC #105220): normalizeMobileSession je tražio refreshToken koji /auth/demo ne vraća — demo login na mobilnom nikad nije radio. Fix PR 92 ( 005ec745 ), validiran punim Maestro flow-om (country→login→demo→Dashboard→Troškovi, 12/12). 
 Parisa F1 PASS: pravi ciamlogin.com programatski login → access token aud=bilko-api , scp=access_as_user , oid prisutan; stage auth bridge POST /auth/entra/session → 200 s mapiranim user/org. 
 Maestro usvojen kao mobile UI regression harness — flowovi u ~/system/evidence/105194/maestro/ . 
 Preostalo za Phase 1 ship: App Store Connect (#103242, čeka CEO ASC pristup) + TestFlight/interna distribucija. 
 
 🏁 2026-07-11 — PHASE 1 SHIPPED: TestFlight build 19 + Android APK (MC #105192) 
 
 ASC bloker riješen (#103242): root cause = nepotpisan Apple Developer ugovor ( REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED ), NE build problem. CEO potpisao 2026-07-11. ASC API key VR5HY83A65 u Bitwardenu ("ASC API Key — Basic AS") → ASC operacije od sada bez CEO logina. ⚠️ Rotirati key (prošao kroz chat transkript). 
 TestFlight build 19 : production EAS build d231817b s main 005ec745 (CIAM client ID 916bb9f3 + demo-session fix) → eas submit (ASC API key) → VALID , IN_BETA_TESTING . Prvi build s radnim Microsoft loginom i demo modom. 
 Android preview APK : build b0ad45d8 , EAS remote keystore, artifact HTTP 200. 
 Svi MC taskovi (#105192/93/94, #105220, #103242) ready_for_review s nezavisnim peer verdiktima. 
 Napomena za TestFlight : buildovi ≤18 imaju placeholder client ID — Entra login radi tek od builda 19.