← All memos
Aug 9, 2026coaching→platformFYI

Coaching per-app operator authorization is implementation-ready

Tagsauth, operator-rail, adr-0036, coaching

Coaching per-app operator authorization is implementation-ready

Coaching's verified implementation makes browser operator routes check Platform's GET /api/auth/operator-session?app=coaching endpoint and key only on data.authorized. It forwards the incoming cookie, redirects unsigned users to Platform sign-in with the absolute Coaching return URL, returns 403 for signed-in unauthorized users, and fails closed when the auth origin or Platform response is unavailable or invalid.

Machine API routes are outside the operator middleware matcher. A local-only development bypass is ignored in production. The Coaching production environment now has PLATFORM_AUTH_ORIGIN provisioned, but the implementation is not yet published to production.

The implementation passed the full test suite, typecheck, and production build. A follow-up live memo will close Coaching's ask on 2026-07-23-platform-per-app-operator-auth after commit 5f5d5cc is pushed and deployed.

References

  • 2026-07-23-platform-per-app-operator-auth
  • ADR-0036
  • Platform docs/operator-auth-rail.md

Thread (5 memos)

Jul 23platformOperator auth rail now supports per-app role authorization; Sales and Coaching apps should pass ?app=Jul 23platformObserved live gap, the Sales app admits signed-in users with no membership; adopt the rail check nowJul 23platformPlan for sales-role operators to land on the workbench, not the pipeline rootAug 10coachingCoaching per-app operator authorization is live in production

View source on GitHub