feat: platform-local authentication — cookie sessions, nc3_auth credential role (US #79 / B3)

.env.example

@@ -31,6 +31,14 @@ NC3_APP_DB_PASSWORD=nc3_app
 # Same raw-interpolation caveat; override PLATFORM_DATABASE_URL instead if the
 # password needs percent-encoding.
 NC3_PLATFORM_DB_PASSWORD=app_platform
+# Credential-surface role (docs/database-roles.md): only the api service
+# connects as nc3_auth. Same bootstrap as the two roles above, once per
+# cluster:
+#   docker compose exec postgres psql -U postgres -d nc3_testing_platform \
+#     -c "ALTER ROLE nc3_auth PASSWORD 'nc3_auth'"
+# Same raw-interpolation caveat; override AUTH_DATABASE_URL instead if the
+# password needs percent-encoding.
+NC3_AUTH_DB_PASSWORD=nc3_auth
 
 # Redis
 REDIS_PORT=6379
@@ -59,6 +67,17 @@ SCAN_HEARTBEAT_INTERVAL_SECONDS=5
 SCAN_STALE_AFTER_SECONDS=30
 SCAN_SWEEP_INTERVAL_SECONDS=15
 
+# Authentication (B3 / US #79)
+# Deployment master key at the root of the envelope hierarchy: 64 hex chars
+# (256 bits). DEVELOPMENT VALUE ONLY — a real deployment mounts a secret and
+# sets APP_ENCRYPTION_MASTER_KEY_FILE=/run/secrets/app_encryption_master_key
+# on the api service alone (workers never unwrap keys). Generate a real one:
+#   openssl rand -hex 32
+APP_ENCRYPTION_MASTER_KEY=00000000000000000000000000000000000000000000000000000000deadbeef
+# Browser origin allowed to make cookie-bearing state changes (CSRF origin
+# check). Leave unset in development; set to the public origin in production:
+#AUTH_PUBLIC_ORIGIN=https://testing.nc3.lu
+
 # Rauthy (development identity provider)
 # Values not listed here live in infra/compose/rauthy/config.toml, which Rauthy requires as a file.
 # The port appears in pub_url, rp_origin, and OIDC_DISCOVERY_URL; changing it changes all three.

.github/workflows/ci.yml

@@ -136,7 +136,8 @@ jobs:
         run: |
           PGPASSWORD=postgres psql -h localhost -U postgres -d postgres \
             -c "ALTER ROLE nc3_app PASSWORD 'nc3_app'" \
-            -c "ALTER ROLE app_platform PASSWORD 'app_platform'"
+            -c "ALTER ROLE app_platform PASSWORD 'app_platform'" \
+            -c "ALTER ROLE nc3_auth PASSWORD 'nc3_auth'"
 
       # The standing regression gate for any RLS policy change (US #81):
       # cross-org, cross-user, guest-arm, worker hint-then-verify, grant
@@ -202,7 +203,8 @@ jobs:
         run: |
           docker compose exec -T postgres psql -U postgres -d nc3_testing_platform \
             -c "ALTER ROLE nc3_app PASSWORD 'nc3_app'" \
-            -c "ALTER ROLE app_platform PASSWORD 'app_platform'"
+            -c "ALTER ROLE app_platform PASSWORD 'app_platform'" \
+            -c "ALTER ROLE nc3_auth PASSWORD 'nc3_auth'"
 
       - name: Scan round trip lands in PostgreSQL
         run: |