Auth0 Configuration

exports.onExecutePostLogin = async (event, api) => {
  const roles = event.user.app_metadata?.roles || [];
  if (roles.length > 0) {
    api.idToken.setCustomClaim("https://gatelithix.com/roles", roles);
    api.accessToken.setCustomClaim("https://gatelithix.com/roles", roles);
  }
};

TOKEN=$(curl -s -X POST "https://gatelithix.us.auth0.com/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{"client_id":"SszFMlZa9HIhRNadnXI6deFzei3ybnGj","client_secret":"'$(gcloud secrets versions access latest --secret=auth0-client-secret --project=gatelithix-core)'","audience":"https://gatelithix.us.auth0.com/api/v2/","grant_type":"client_credentials"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
 
# Find user by email
curl -s "https://gatelithix.us.auth0.com/api/v2/users?q=email:USER@EXAMPLE.COM" \
  -H "Authorization: Bearer $TOKEN" | python3 -c "import sys,json; [print(u['user_id']) for u in json.load(sys.stdin)]"
 
# Assign role (URL-encode the user_id: | → %7C)
curl -s -X PATCH "https://gatelithix.us.auth0.com/api/v2/users/USER_ID_HERE" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"app_metadata":{"roles":["platform_admin"]}}'

gcloud compute security-policies rules create 900 \
  --security-policy=frontend-waf \
  --project=gatelithix-core \
  --action=allow \
  --expression="request.path == '/' && request.query.matches('code=.*&state=.*')" \
  --description="Allow Auth0 OAuth callback (code+state params trigger false positive on sqli-v33)"

# Check current callback URLs via Management API
TOKEN=$(curl -s -X POST "https://gatelithix.us.auth0.com/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{"client_id":"SszFMlZa9HIhRNadnXI6deFzei3ybnGj","client_secret":"'$(gcloud secrets versions access latest --secret=auth0-client-secret --project=gatelithix-core)'","audience":"https://gatelithix.us.auth0.com/api/v2/","grant_type":"client_credentials"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
 
# View current callbacks
curl -s "https://gatelithix.us.auth0.com/api/v2/clients/I1rEXZhT4pRcHIBYXoUG3x0J2NgVuZKq?fields=callbacks" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
 
# Fix: set callbacks to match what the app sends (window.location.origin)
# Production only — no localhost (OAuth redirect attack vector)
curl -s -X PATCH "https://gatelithix.us.auth0.com/api/v2/clients/I1rEXZhT4pRcHIBYXoUG3x0J2NgVuZKq" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"callbacks":["https://dashboard.paylithix.com"],"allowed_logout_urls":["https://dashboard.paylithix.com"],"web_origins":["https://dashboard.paylithix.com"]}'

# Check what the admin image was built with
curl -s https://dashboard.paylithix.com/ | grep -o 'auth0[^"]*' | head -5
 
# Check GitHub Actions vars
gh variable list --repo paylithix/paylithix-gateway | grep AUTH0

# Verify JWKS endpoint is reachable
curl -s https://gatelithix.us.auth0.com/.well-known/jwks.json | jq '.keys | length'
 
# Check gateway Auth0 config
gcloud run services describe api-gateway --project=gatelithix-core --region=us-central1 \
  --format="value(spec.template.spec.containers[0].env)" | tr ';' '\n' | grep AUTH0
 
# Verify Secret Manager has real secret (not placeholder)
gcloud secrets versions access latest --secret=auth0-client-secret --project=gatelithix-core | head -c 10

# Get a fresh Management API token (24-hour expiry)
# Go to Auth0 Dashboard → APIs → Auth0 Management API → API Explorer tab → Copy token
 
# Or use M2M credentials:
curl -s -X POST "https://gatelithix.us.auth0.com/oauth/token" \
  -H "Content-Type: application/json" \
  --data '{
    "client_id": "SszFMlZa9HIhRNadnXI6deFzei3ybnGj",
    "client_secret": "'$(gcloud secrets versions access latest --secret=auth0-client-secret --project=gatelithix-core)'",
    "audience": "https://gatelithix.us.auth0.com/api/v2/",
    "grant_type": "client_credentials"
  }' | jq -r '.access_token'
 
# List applications
curl -s "https://gatelithix.us.auth0.com/api/v2/clients" \
  -H "Authorization: Bearer $TOKEN" | jq '.[].name'
 
# List users
curl -s "https://gatelithix.us.auth0.com/api/v2/users" \
  -H "Authorization: Bearer $TOKEN" | jq '.[].email'