app.lssm-ecosystem-web

LSSM ecosystem web

Host-aware Next.js acquisition and identity shell for the LSSM ecosystem.

Identity

os.lssm.tech is an OIDC relying party of https://id.lssm.co. Its dedicated https://api.os.lssm.tech authority owns the host-scoped product session and local membership; no cookie is shared with the identity host or another product. Runtime activation is fail-closed behind:

• NEXT_PUBLIC_LSSM_OS_RP_ENABLED=1 in this web app.
• NEXT_PUBLIC_LSSM_OS_API_ORIGIN=https://api.os.lssm.tech in this web app.
• LSSM_OS_RP_ENABLED=1, LSSM_OS_RP_SECURITY_REVIEW_REF, and a 32+ character LSSM_OS_RP_CLIENT_SECRET in the dedicated LSSM OS API deployment.

The private console checks /api/lssm-os/auth/session, which requires an active product-local membership. A generic Better Auth identity session is not sufficient.

The protected production replay is fail-closed. bun run test:production-oidc-canary skips unless LSSM_OS_PRODUCTION_CANARY_AUTHORIZED=1, the exact E2E_PRODUCTION_BASE_URL=https://console.lssm.tech, and secret-managed E2E_TEST_EMAIL / E2E_TEST_PASSWORD values are all present. It verifies central sign-in and optional consent, the os.lssm.tech callback, active local membership, the console session and module surface, product-local sign-out, denied post-sign-out session resolution, and independent Passport sign-out. Credentials stay process-local and are never written to evidence output.

Waitlist requests use the central product-scoped lifecycle with applicationId=app_lssm_os.

Local development

bun run dev defaults localhost to the LSSM OS host narrative. Set LSSM_LOCAL_SITE to company, world, technology, or console to inspect another host locally.

Provider preview

For a bounded hosting-recovery canary, set LSSM_ATLAS_PREVIEW_SITE=company. The application accepts that selection only when the request host exactly matches RAILWAY_PUBLIC_DOMAIN or VERCEL_URL; an arbitrary provider-domain suffix remains unrecognized. Production hosts and canonicals are unchanged.

Better Auth 1.7 callback forwarding

The existing public LSSM callback alias forwards only its bounded authorization response to the fixed API owner's /auth/callback/ endpoint, replacing the removed /auth/oauth2/callback/ path. Existing issuer and parameter checks remain in force. API token exchange, provider registrations, cookies and account-identity migration still require live qualification before cutover.

Build compute policy

Automatic Vercel Git builds are disabled for this app. Build compute is assigned to Railway; this does not change the existing runtime or domain topology. See the operator policy and evidence^† for configuration scope and the unqualified Vercel prebuilt delivery gap.