# Live Phase 2A — Auth Bridge Report

**Status:** COMPLETE (authentication only)  
**Date:** 2026-07-24  
**Workspace:** `/Users/bradcamp/Desktop/The Complete Istockhomes/`  
**Target:** `/public_html/live/`  
**Authorization:** Brad — Phase 2A One Login. One Business. One Trust Layer.

## BUILD LOCK (opening)

1. **Canonical workspace:** `/Users/bradcamp/Desktop/The Complete Istockhomes` (`live/` + minimal App2 auth handoff).
2. **Task:** Connect Live Sign In to existing App2 authentication; recognize user, business, verification; first-use purpose + approval; approved dashboard buttons only.
3. **Directives:** 001 One Foundation · One Only One · Live as platform service (not second Foundation).
4. **Protected:** `App/secure/` secrets (OpenAI One Key untouched); no new users/businesses/password tables; no streaming.
5. **Rollback:** Restore via git / prior deploy zip; markers in `_backups/2026-07-24-live-phase2a/`; remove `App/secure/live/approvals/` JSON if created; revert App2 bootstrap/login/login-2fa. Docs: `Deployment-History/2026-07-24/`.
6. **Tests:** See Regression section below.

## Authentication flow

```
Visit /live/
  ├─ Logged out → Sign In button → /live/signin.php
  │     └─ POST email/password → App2 API auth.login
  │           ├─ requires_2fa → shared session pending token → /App2/login-2fa.php → return to /live/
  │           └─ token → $_SESSION['token'] (same keys as App2; cookie path=/)
  │                 └─ auth.me → user id/email/certified_by_istockhomes
  │                       └─ franchise.listMine + franchise.status → business + verified?
  │
  ├─ Already signed in on App2 (shared session) → Live recognizes same token via auth.me
  │
  └─ Gates
        ├─ Not verified business → “Business verification required…”
        ├─ First use → purpose form → store under App/secure/live/approvals/
        │     └─ auto_approve_when_verified (Phase 2A config) → approved | else pending
        └─ Approved → Go Live Now + Schedule Live (buttons only; no stream)
```

Logout: `/live/logout.php` calls `auth.logout` and destroys the shared PHP session (logs out App2 too).

## Files changed

### Created — Live

| File |
|------|
| `live/signin.php` |
| `live/logout.php` |
| `live/includes/http.php` |
| `live/includes/auth.php` |
| `live/includes/approvals.php` |
| `live/docs/MIGRATION_023_LIVE_APPROVALS_NOT_EXECUTED.md` |
| `live/docs/PHASE2A_AUTH_REPORT.md` (this file) |
| `App/secure/live/approvals/.htaccess` |
| `App/secure/live/approvals/README.md` |

### Modified — Live

| File | Change |
|------|--------|
| `live/includes/bootstrap.php` | Shared session cookie path=/; load auth |
| `live/includes/helpers.php` | Approval helpers wired to secure store |
| `live/includes/layout.php` | Sign In / Logout / user chip |
| `live/includes/config.php` | (defaults still Phase-aware via secure config) |
| `live/index.php` | Auth-aware home + Sign In CTA |
| `live/dashboard.php` | Identity, verification, Live status, gates |
| `live/go-live.php` | Auth + verification + purpose + approved buttons |
| `live/schedule-live.php` | Require login |
| `live/assets/live.css` | Header auth actions only |
| `App/secure/live/live-config.php` | Phase 2 + auto_approve_when_verified |

### Modified — App2 (auth integration only)

| File | Change |
|------|--------|
| `App2/bootstrap.php` | Cookie path=/; `app2_safe_return_path` / `app2_consume_return_after_login` |
| `App2/login.php` | Honor `?return=` / POST return for `/live/…` handoff |
| `App2/login-2fa.php` | Consume return after 2FA |

## Database

- **No schema changes executed.**
- Migration 023 documented: `live/docs/MIGRATION_023_LIVE_APPROVALS_NOT_EXECUTED.md`
- Interim approvals: `App/secure/live/approvals/{franchise_id}.json`

## Secrets

- **None changed.** OpenAI-One-Key.php not loaded by Live. No keys in `/live/`.

## Regression tests

| # | Test | Result |
|---|------|--------|
| 1 | PHP lint Live + App2 touched files | See CLI run |
| 2 | Safe return path rejects open redirects | CLI |
| 3 | Approval save/load pending/approved (secure folder) | CLI |
| 4 | Existing App2 login/logout/dashboard | VERIFY on server (unchanged auth.login core) |
| 5 | Live Sign In → auth.login | VERIFY on server with Brad credentials |
| 6 | Session persistence App2↔Live (cookie path=/) | VERIFY on server |
| 7 | Business + verification detection | VERIFY on server |
| 8 | First-use purpose → approved buttons | VERIFY on server |
| 9 | Logout clears shared session | VERIFY on server |
| 10 | `App/secure/live/` web-inaccessible | VERIFY on server (`.htaccess` Deny) |
| 11 | No streaming / WebRTC added | PASS (code review) |

## Screenshots

Browser screenshots against production require Brad’s live credentials and deployed files. Local shells render Sign In / Dashboard / Purpose / Approved button states; capture after deploy:

1. Logged out `/live/`
2. `/live/signin.php`
3. Verified business dashboard
4. First-use purpose form
5. Approved dashboard with Go Live Now / Schedule Live

## Rollback

1. Restore App2 files: `bootstrap.php`, `login.php`, `login-2fa.php` from pre-2A copies or git.
2. Restore or delete Phase 2A Live files listed above; restore Phase 1 versions of `index.php`, `dashboard.php`, `go-live.php`, `layout.php`, `helpers.php`, `bootstrap.php`, `schedule-live.php`, `live.css`.
3. Delete `live/signin.php`, `live/logout.php`, `live/includes/auth.php`, `live/includes/http.php`, `live/includes/approvals.php`.
4. Optionally remove `App/secure/live/approvals/` JSON files (keep folder or delete).
5. Restore `App/secure/live/live-config.php` to Phase 1 version.
6. Confirm App2 login still works; confirm `/live/` Phase 1 shells load.

## STOP

Phase 2A stops at authentication. Not started: streaming, WebRTC, LiveKit, payments, recording, chat, QR, moderation engine.