fix(docker): give a preview its own login apps and signing key

A preview starts from a clone of another instance's database and reads it
with that instance's encryption key, because that is the only key those
rows can be read with. The same key unseals the source's JWT signing key
and decrypts its OAuth client secrets, so a preview inherited both.

Sign-in could therefore never work: the cloned OAuth apps are registered
against the source's hostname, and a provider rejects every authorization
request that starts from a preview host. The preview also minted its own
tokens signed with the source instance's production signing key.

The clone is now re-homed before the application server starts. Emptying
login_provider, jwt_signing_key and issued_jwt makes the preview rebuild
each from its own configuration on boot. Accounts are untouched, because
identity_link keys on identity_provider rather than on login_provider.

The policy moves out of a shell heredoc into sanitize.sql, organised by
the two questions it answers — a clone must not act, and a clone must not
keep the source instance's identity — so it can be read and diffed as SQL.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZADQeSx6zQNNqsdu7AAqZ

Author: FelixTJDietrich

.changeset/preview-owns-its-login-identity.md

@@ -0,0 +1,5 @@
+---
+"hephaestus": patch
+---
+
+Pull request previews now sign in through their own login apps instead of the ones they cloned. A preview starts from a copy of another instance's database, and it used to keep that instance's OAuth registrations — whose callback URLs belong to the original hostname, so every sign-in attempt was rejected by the provider before it began. A preview now rebuilds its login providers from its own configuration on first boot, and mints its own token-signing key rather than reusing the cloned one. Existing accounts are unaffected: signing in through the preview's own app lands on the same account as before.

docker/preview/README.md

@@ -22,9 +22,13 @@ Before the first restore, the seeder recreates only the uniquely resolved previe
 both succeed. A failed or partial first attempt can therefore retry cleanly, while redeploying an
 already seeded PR preserves changes made while testing. A new preview volume gets a fresh staging clone.
 
-## Silence policy
+## Preview policy
 
-Before the application server starts, `seed-loader`:
+`seed-loader` applies [`sanitize.sql`](./sanitize.sql) to the restored clone before the application
+server starts. A clone is another instance's live database, so the policy answers two questions, and
+the file is organised by them.
+
+### Silence — a clone must not act
 
 1. disables automatic and manual practice-review triggers for every workspace;
 2. disables each `PRACTICE_REVIEW` model binding while preserving its selected model;
@@ -37,6 +41,29 @@ visible in the UI. To test reviews for one workspace, enable its practice-review
 enable the desired manual or automatic trigger in that workspace's practice-review settings. Those
 changes persist for the lifetime of the PR preview.
 
+### Re-home — a clone must not keep the source instance's identity
+
+A preview runs with the **source instance's** `HEPHAESTUS_SECURITY_ENCRYPTION_KEY`, because that is the
+only key the cloned rows can be read with. Without it the preview boots and then fails every request
+that touches a credential, with `AEADBadTagException: Tag mismatch` in the log. That key also unseals
+the source's JWT signing key and decrypts its OAuth client secrets, so three tables are emptied and
+rebuilt from this deployment's own configuration:
+
+| Table | Why it cannot be inherited |
+|---|---|
+| `login_provider` | The source's OAuth apps are registered against the source's hostname, so the provider rejects every sign-in that starts from a preview host |
+| `jwt_signing_key` | The preview would otherwise mint its own tokens signed with the source instance's production signing key |
+| `issued_jwt` | Cloned sessions belong to the source instance's users |
+
+`LoginProviderService` seeds `login_provider` from the environment whenever a registration id is
+absent, so emptying the table hands the preview its own login apps on the next boot — which is why the
+preview stack needs `GITHUB_OAUTH_*` (and any other provider it should offer) pointed at an OAuth app
+whose callback covers the preview hostnames. A provider with no credentials in the preview environment
+is simply not offered; Slack, being link-only, is normally absent for that reason.
+
+Accounts survive all of this: `identity_link` keys on `identity_provider`, not on `login_provider`, so
+a cloned user signs in through the preview's own OAuth app and lands on the same account.
+
 ## One-time server and Coolify setup
 
 1. Keep staging's `nats-server` attached to the external Docker network `shared-network`.
@@ -45,11 +72,14 @@ changes persist for the lifetime of the PR preview.
    joins `shared-network` as a second network.
 4. Set `PREVIEW_SEED_SOURCE_CONTAINER=app-postgres-1` if the staging Compose project/container name
    ever changes. The source user defaults to `root` and database to `hephaestus`.
-5. Assign the web and API services sibling wildcard domains. With the current template these are
+5. Set `HEPHAESTUS_SECURITY_ENCRYPTION_KEY` to the **seed source instance's** key, and point
+   `GITHUB_OAUTH_CLIENT_ID`/`_SECRET` at an OAuth app whose callback covers the preview hostnames —
+   see the re-home policy above for both.
+6. Assign the web and API services sibling wildcard domains. With the current template these are
    `pr<id>.hephaestus.felixdietrich.com` and `pr<id>.api.hephaestus.felixdietrich.com`.
-6. Leave the preview `IMAGE_TAG` unset. Coolify injects `SOURCE_COMMIT`, and CI publishes the matching
+7. Leave the preview `IMAGE_TAG` unset. Coolify injects `SOURCE_COMMIT`, and CI publishes the matching
    application-server image before the preview update is requested.
-7. Put every preview-safe value in the application's **base** environment variables, not in Coolify's
+8. Put every preview-safe value in the application's **base** environment variables, not in Coolify's
    separate preview-variable scope. See below.
 
 ## Why the safe values live in Coolify's base scope

docker/preview/compose.app.yaml

@@ -115,49 +115,18 @@ services:
           -U hephaestus -d hephaestus \
           --exit-on-error --no-owner --no-privileges < /tmp/seed.dump
 
-        echo "Applying preview silence policy"
-        docker exec -i "$$PREVIEW_PG" psql -v ON_ERROR_STOP=1 -U hephaestus -d hephaestus <<'SQL'
-        UPDATE workspace
-           SET practice_review_auto_trigger_enabled = FALSE,
-               practice_review_manual_trigger_enabled = FALSE;
-
-        UPDATE workspace_agent_binding
-           SET enabled = FALSE,
-               updated_at = NOW()
-         WHERE purpose = 'PRACTICE_REVIEW';
-
-        UPDATE review_sweep_schedule
-           SET enabled = FALSE,
-               updated_at = NOW();
-
-        UPDATE agent_job
-           SET status = 'CANCELLED',
-               completed_at = COALESCE(completed_at, NOW()),
-               worker_id = NULL,
-               error_message = 'Cancelled when staging data was cloned into a preview.',
-               cancellation_reason = NULL
-         WHERE status IN ('QUEUED', 'RUNNING');
-
-        UPDATE agent_job
-           SET delivery_status = 'FAILED',
-               error_message = CONCAT_WS(E'\n', NULLIF(error_message, ''),
-                   'Delivery paused when staging data was cloned into a preview.')
-         WHERE status = 'COMPLETED'
-           AND delivery_status = 'PENDING';
-
-        UPDATE sync_job
-           SET status = 'CANCELLED',
-               cancel_requested = TRUE,
-               finished_at = COALESCE(finished_at, NOW()),
-               heartbeat_at = NULL,
-               error_summary = 'Cancelled when staging data was cloned into a preview.'
-         WHERE status IN ('PENDING', 'RUNNING');
-        SQL
+        echo "Applying the preview policy"
+        test -s /preview/sanitize.sql
+        docker exec -i "$$PREVIEW_PG" psql \
+          -v ON_ERROR_STOP=1 -U hephaestus -d hephaestus < /preview/sanitize.sql
 
         docker exec "$$PREVIEW_PG" touch /var/lib/postgresql/data/.hephaestus-preview-seeded
-        echo "Seed loaded; every cloned workspace starts with practice reviews paused"
+        echo "Seed loaded; reviews are paused and the preview owns its login apps and signing key"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
+      # The policy this preview is held to, kept next to the stack it applies to rather than inline
+      # in a shell heredoc where it cannot be read, reviewed or diffed as SQL.
+      - ./sanitize.sql:/preview/sanitize.sql:ro
     restart: "no"
     deploy:
       resources:

docker/preview/sanitize.sql

@@ -0,0 +1,72 @@
+-- Applied once to a freshly restored clone, before this preview's application server starts.
+--
+-- The clone is another instance's live database, so two things have to be made true before it boots.
+--
+--   1. SILENCE — a clone must not act. It holds real workspaces, real connections and real
+--      credentials, so everything that would post, deliver or schedule work still points at the
+--      originals. Triggers, schedules and in-flight jobs are stopped. Nothing is deleted: the data
+--      and the settings stay visible, and a tester can re-enable one workspace deliberately.
+--
+--   2. RE-HOME — a clone must not keep the source instance's identity. A preview reads the clone
+--      with the source instance's encryption key, because that is the only key those rows can be
+--      read with. The same key also unseals the source's JWT signing key and decrypts its OAuth
+--      client secrets. Both belong to the source deployment, not this one, and are replaced here.
+--
+-- seed-loader runs this with ON_ERROR_STOP=1 and does not write the seed marker unless it succeeds,
+-- so a preview is never left half-sanitized: the next deployment retries the whole clone.
+
+-- ─── 1. Silence ──────────────────────────────────────────────────────────────────────────────────
+
+UPDATE workspace
+   SET practice_review_auto_trigger_enabled = FALSE,
+       practice_review_manual_trigger_enabled = FALSE;
+
+UPDATE workspace_agent_binding
+   SET enabled = FALSE,
+       updated_at = NOW()
+ WHERE purpose = 'PRACTICE_REVIEW';
+
+UPDATE review_sweep_schedule
+   SET enabled = FALSE,
+       updated_at = NOW();
+
+UPDATE agent_job
+   SET status = 'CANCELLED',
+       completed_at = COALESCE(completed_at, NOW()),
+       worker_id = NULL,
+       error_message = 'Cancelled when staging data was cloned into a preview.',
+       cancellation_reason = NULL
+ WHERE status IN ('QUEUED', 'RUNNING');
+
+UPDATE agent_job
+   SET delivery_status = 'FAILED',
+       error_message = CONCAT_WS(E'\n', NULLIF(error_message, ''),
+           'Delivery paused when staging data was cloned into a preview.')
+ WHERE status = 'COMPLETED'
+   AND delivery_status = 'PENDING';
+
+UPDATE sync_job
+   SET status = 'CANCELLED',
+       cancel_requested = TRUE,
+       finished_at = COALESCE(finished_at, NOW()),
+       heartbeat_at = NULL,
+       error_summary = 'Cancelled when staging data was cloned into a preview.'
+ WHERE status IN ('PENDING', 'RUNNING');
+
+-- ─── 2. Re-home ──────────────────────────────────────────────────────────────────────────────────
+
+-- Cloned sessions were issued by the source instance to its users. A preview has no use for them,
+-- and they are the only thing that could carry a signed-in session across the clone.
+DELETE FROM issued_jwt;
+
+-- Left in place, this preview would mint its own tokens signed with the source instance's
+-- production signing key. Emptied, JwtSigningKeyService bootstraps a sealed signing identity that
+-- belongs to this preview alone.
+DELETE FROM jwt_signing_key;
+
+-- The cloned rows carry the source instance's OAuth apps, whose callback URLs are registered
+-- against the source's hostname — a provider rejects every sign-in that starts from a preview host.
+-- LoginProviderService seeds this table from this deployment's own environment when a registration
+-- id is absent, so emptying it hands the preview its own login apps. Accounts are unaffected:
+-- identity_link keys on identity_provider, not on this table.
+DELETE FROM login_provider;