Deploy prerequisites for PR #234 security hardening (breaking without config)

[4444J99]

main is live-deployed, and PR #234 is breaking unless these are in place first. This issue is the merge/deploy gate.

Must be done before merging/deploying #234

• Auth0: issue an org_id claim (and optionally tier) on access tokens. The multi-tenant IDOR fix derives org from this claim; without it, /api/deals and /api/contacts return 403 for every user (fail-closed by design). Namespaced custom claims (https://…/org_id) are supported.
• Set webhook secrets in prod: STRIPE_WEBHOOK_SECRET, TWILIO_AUTH_TOKEN, SENDGRID_WEBHOOK_VERIFICATION_KEY, PLAID_WEBHOOK_SECRET. Verifiers now fail closed (401) when unset (previously fail-open).
• Ensure JWT_SECRET is set in every environment — validateConfig() now throws on boot if missing (insecure fallback removed).
• Run the app under a non-owner DB role so RLS (migration 018) actually enforces — the table owner bypasses non-FORCEd policies. The per-request app.current_org_id GUC is wired via orgContextMiddleware.
• Coordinate migrations 014–019 rollout — 014 sets prospects.org_id NOT NULL and backfills existing rows to a default "Unassigned" org.
• Confirm organizations.subscription_tier → data-tier mapping matches product intent (dataTier entitlement now reads this column; the x-data-tier header is ignored).

Ref: PR #234, docs/logos/praxis.md §C.

[4444J99]

The deploy-prerequisite checklist is now documented in-repo (PR #263):

• docs/DEPLOYMENT.md §2 — the boot-blocking config (JWT_SECRET, DATABASE_URL, CORS_ORIGIN, the four webhook signing secrets), the Auth0 org_id claim requirement, migrations 013–019 ordering, and the non-owner Postgres role needed for RLS — all cross-checked against validateConfig() in server/config/index.ts.
• .env.example — new "PRODUCTION DEPLOYMENT — REQUIRED SECRETS" section with each variable annotated.

This documents the gate; the actual provisioning (Auth0 claim, prod secrets, DB role) still has to happen in the deploy environment before merging/deploying #234.

---

Generated by Claude Code

[4444J99]

Engaged triage: still current. The prerequisite list remains accurate, and PR #263 captured the in-repo documentation side, but the live deploy-environment changes themselves are still outstanding.

Next concrete step: provision the Auth0 org claim, webhook secrets, JWT secret, non-owner DB role, and migration rollout in the target environment, then record the environment receipt before PR #234 is treated as deployable.

[4444J99]

Item-specific execution plan

Outcome
Make PR #234 deploy-safe by satisfying and proving every production prerequisite before its fail-closed authentication, webhook, boot-config, RLS, entitlement, and migration changes reach production.

Dependencies
PR #234’s exact head and migrations 014–019 are the implementation source. This gate depends on Auth0 tenant configuration, production secret stores, a non-owner PostgreSQL runtime role, existing-row migration analysis, and an approved subscription-tier mapping.

Ordered work packets

1. Freeze PR Audit remediation: security, compliance, and correctness fixes #234’s exact head, enumerate each target environment, identify accountable owners, and prevent merge/deploy until this issue’s evidence matrix is complete.
2. Configure and verify Auth0 access tokens containing supported org_id and optional tier claims; test valid, missing, malformed, cross-org, and namespaced-claim cases.
3. Set Stripe, Twilio, SendGrid, Plaid, and JWT secrets in every target secret store without copying secret values into GitHub; retain only redacted configuration receipts.
4. Provision and exercise a non-owner database runtime role; prove RLS isolation with positive same-org and negative cross-org queries.
5. Dry-run migrations 014–019 against a production-shaped backup, inspect the “Unassigned” backfill, measure lock/downtime risk, and document rollback/restore steps.
6. Obtain product-owner approval for subscription_tier → data-tier entitlements and add regression coverage for the approved mapping.
7. Deploy to staging, run API/webhook/boot/RLS smoke and failure tests, then record a go/no-go receipt for production promotion.
8. Merge/promote only after every row in the environment matrix has an attributable receipt; monitor health and preserve rollback evidence.

Verification / acceptance evidence

• Focused tests for the changed behavior; repository lint/typecheck/build/test commands where applicable; clean diff and exact commit SHA in the owning PR.
• A final evidence comment must name the exact head SHA, commands/checks and results, changed paths or artifacts, external receipts, and any residual risk.

Human / external gates
Named owners must perform or approve Auth0, secret, database-role, billing-entitlement, migration, and production-promotion actions. Automation may validate and prepare redacted evidence but must not infer their completion.

Next valid action
Create the per-environment prerequisite/evidence matrix against PR #234’s current exact head and assign each external control to an accountable owner.

This plan is a coordination contract, not completion evidence. Do not close this issue until every prerequisite is evidenced and PR #234 is proven safe to promote.