fix(dev-compose): authenticator dev bring-up (build binary, mount + named-curve key)

.env.compose.example

@@ -118,20 +118,13 @@ SEEDED_LOCAL_CH=
 # Replace with the UUID present in your persons.insight_tenant_id.
 TENANT_DEFAULT_ID=00000000-df51-5b42-9538-d2b56b7ee953
 
-# The api-gateway dev command uses no-auth.yaml (auth_disabled=true) by
-# default — all requests get root context. The plugin demands a non-empty
-# issuer_url even when auth is off, so no-auth.yaml ships with a
-# placeholder (https://no-auth.local/oauth2/default) that is never
-# actually contacted.
+# The api-gateway runs no-auth.yaml (auth_disabled=true) — all requests get
+# the default-tenant root context, and the frontend dev-impersonates
+# VITE_DEV_USER_EMAIL (below). OIDC login via the authenticator is not wired
+# up for the compose dev stack.
 #
-# To enable real OIDC: edit src/backend/services/api-gateway/config/no-auth.yaml
-# directly (it's bind-mounted; watchexec reloads). Flip auth_disabled to
-# false, set oidc-authn-plugin.issuer_url + audience and
-# auth-info.client_id / scopes. See CONTRIBUTING.md "Switch the gateway
-# to real OIDC".
-#
-# The variables below are kept for the frontend (which reads
-# VITE_OIDC_ISSUER / VITE_OIDC_CLIENT_ID).
+# The OIDC_* vars below are read by the frontend (VITE_OIDC_ISSUER /
+# VITE_OIDC_CLIENT_ID) but are unused while dev-impersonation is active.
 OIDC_ISSUER=
 # Also the authenticator's OIDC client_id (must equal fakeidp's default aud so
 # the id_token audience matches). Defaults to `insight-authenticator`.

dev-compose.sh

@@ -124,10 +124,20 @@ EOF
 ensure_authenticator_dev_key() {
   local dir="deploy/compose/authenticator-dev-keys"
   local key="$dir/current.pem"
-  [[ -f "$key" ]] && return 0
+  # Reuse an existing key only if it is a usable named-curve P-256 key. A key
+  # generated by an older dev-compose.sh on LibreSSL carries explicit EC
+  # parameters the authenticator's p256 loader rejects — regenerate those.
+  if [[ -f "$key" ]]; then
+    openssl asn1parse -in "$key" 2>/dev/null | grep -q prime256v1 && return 0
+    echo "=== Regenerating authenticator dev key ($key): not named-curve P-256 ===" >&2
+    rm -f "$key"
+  fi
   mkdir -p "$dir"
   echo "=== Generating dev ES256 signing key for the authenticator ($key) ==="
-  if ! openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "$key" 2>/dev/null; then
+  # ec_param_enc:named_curve is REQUIRED: LibreSSL (macOS default openssl)
+  # otherwise emits explicit EC parameters, which the authenticator's p256
+  # PKCS#8 loader rejects ("expected OBJECT IDENTIFIER, got SEQUENCE").
+  if ! openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out "$key" 2>/dev/null; then
     echo "WARN: openssl unavailable — the authenticator will fail to start without $key" >&2
     return 1
   fi
@@ -260,7 +270,10 @@ YML
   # ── Build phase ──────────────────────────────────────────────────
   if [[ "$skip_build" != "true" ]]; then
     echo "=== Building artefacts (skip with --skip-build) ==="
-    local rust_bins=""
+    # authenticator is always built from source (no ghcr flip for it) and its
+    # binary is bind-mounted as a file — omit it and compose auto-creates the
+    # mount source as an empty directory, failing container init.
+    local rust_bins="authenticator"
     contains "$ghcr_list" api-gateway || rust_bins="$rust_bins insight-api-gateway"
     contains "$ghcr_list" analytics   || rust_bins="$rust_bins analytics"
     rust_bins=$(trim "$rust_bins")
@@ -275,9 +288,10 @@ YML
           apt-get update && apt-get install -y --no-install-recommends \
             protobuf-compiler libprotobuf-dev pkg-config libssl-dev > /dev/null
           cargo build --release$bin_flags
-          mkdir -p /out/api-gateway /out/analytics
+          mkdir -p /out/api-gateway /out/analytics /out/authenticator
           [ -f /target/release/insight-api-gateway ] && install -m 0755 /target/release/insight-api-gateway /out/api-gateway/insight-api-gateway || true
           [ -f /target/release/analytics ]           && install -m 0755 /target/release/analytics           /out/analytics/analytics || true
+          [ -f /target/release/authenticator ]       && install -m 0755 /target/release/authenticator       /out/authenticator/authenticator || true
         "
     fi
     if ! contains "$ghcr_list" identity; then
@@ -395,9 +409,10 @@ pick it up via ENABLE_AUTO_RELOAD.
 Targets:
   api-gateway        Rust gateway binary only.
   analytics          Rust analytics binary only.
+  authenticator      Rust authenticator binary only.
   identity           .NET 9 publish output.
   frontend           pnpm build → dist/.
-  rust               Both Rust services.
+  rust               All three Rust services.
   all                Everything (Rust + .NET + frontend).
 EOF
 }
@@ -423,20 +438,22 @@ cmd_build() {
       apt-get update && apt-get install -y --no-install-recommends \
         protobuf-compiler libprotobuf-dev pkg-config libssl-dev > /dev/null
       cargo build --release$bin_flags
-      mkdir -p /out/api-gateway /out/analytics
+      mkdir -p /out/api-gateway /out/analytics /out/authenticator
       [ -f /target/release/insight-api-gateway ] && install -m 0755 /target/release/insight-api-gateway /out/api-gateway/insight-api-gateway || true
       [ -f /target/release/analytics ]           && install -m 0755 /target/release/analytics           /out/analytics/analytics || true
+      [ -f /target/release/authenticator ]       && install -m 0755 /target/release/authenticator       /out/authenticator/authenticator || true
     "
   }
 
   case "$target" in
-    api-gateway) build_rust_bins insight-api-gateway ;;
-    analytics)   build_rust_bins analytics ;;
-    rust)        build_rust_bins insight-api-gateway analytics ;;
+    api-gateway)   build_rust_bins insight-api-gateway ;;
+    analytics)     build_rust_bins analytics ;;
+    authenticator) build_rust_bins authenticator ;;
+    rust)          build_rust_bins insight-api-gateway analytics authenticator ;;
     identity)    "${compose_cmd[@]}" run --rm build-dotnet ;;
     frontend)    "${compose_cmd[@]}" run --rm build-frontend ;;
     all)
-      build_rust_bins insight-api-gateway analytics
+      build_rust_bins insight-api-gateway analytics authenticator
       "${compose_cmd[@]}" run --rm build-dotnet
       "${compose_cmd[@]}" run --rm build-frontend
       ;;
@@ -522,6 +539,8 @@ The main pass removes:
   • named volumes: mariadb-data, clickhouse-data, clickhouse-logs,
     redis-data, redpanda-data, rust-target, frontend-node-modules
   • host-side build artefacts under deploy/compose/build/
+  • the generated authenticator dev signing key
+    (deploy/compose/authenticator-dev-keys/)
   • generated deploy/compose/override.generated.yml
   • .env.compose
 
@@ -540,6 +559,7 @@ This will permanently remove the local Insight stack state:
   • named volumes (mariadb-data, clickhouse-data, redis-data,
     redpanda-data, rust-target, frontend-node-modules, ...)
   • deploy/compose/build/ artefacts
+  • deploy/compose/authenticator-dev-keys/ (dev signing key)
   • deploy/compose/override.generated.yml
   • .env.compose
 
@@ -576,6 +596,10 @@ EOF
     echo "Removing deploy/compose/build/..."
     rm -rf deploy/compose/build/
   fi
+  if [[ -d deploy/compose/authenticator-dev-keys ]]; then
+    echo "Removing deploy/compose/authenticator-dev-keys/ (dev signing key)..."
+    rm -rf deploy/compose/authenticator-dev-keys/
+  fi
   if [[ -f "$override" ]]; then
     echo "Removing $override..."
     rm -f "$override"

docker-compose.yml

@@ -327,6 +327,7 @@ services:
     volumes:
       - ./deploy/compose/build/authenticator/authenticator:/app/authenticator:ro
       - ./src/backend/services/authenticator/config:/app/config:ro
+      - ./deploy/compose/authenticator-dev-keys:/app/keys:ro
     command:
       - "/app/authenticator" # <watched path>
       - "--"