From 2bd4172f8191bd05a974f3ca7bc7af749bfc6cf2 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Sat, 31 Oct 2026 18:16:27 -0700 Subject: [PATCH] chore(staging): allowlist example.invalid so the first-user walk runs E2E (TASK-706) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The daily first-user walk (scripts/first-user-walk.mjs, #3107) signs up as walk-@example.invalid. Staging gates signup via AUTH_ALLOWED_DOMAINS, so the walk stopped at signup with a 403 INSTANCE_ACCESS_RESTRICTED. example.invalid is an RFC-6761 reserved, non-registrable, non-deliverable domain, added beside the existing reserved ops.commonly.invalid — it opens staging signup only to the walk's throwaway test addresses. Prod (values-dev) sets no authAllowedDomains and stays public/unchanged. The walk deletes its accounts by id after each run. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_015AKgpNr8tFMMj8aFvFPUdA --- k8s/helm/commonly/values-staging.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/k8s/helm/commonly/values-staging.yaml b/k8s/helm/commonly/values-staging.yaml index 0df2880a8e..a6c246c43d 100644 --- a/k8s/helm/commonly/values-staging.yaml +++ b/k8s/helm/commonly/values-staging.yaml @@ -183,7 +183,7 @@ backend: # Individual team emails are PII and live in the GCP SM secret # commonly-staging-auth-allowed-emails (NOT in this repo), surfaced via the # api-keys ExternalSecret → AUTH_ALLOWED_EMAILS when the flag below is true. - authAllowedDomains: "seed.staging.commonly.me,ops.commonly.invalid" + authAllowedDomains: "seed.staging.commonly.me,ops.commonly.invalid,example.invalid" authAllowedEmailsFromSecret: true # Smaller Postgres pool for staging's Aiven db (fewer connections than prod). pgPoolMax: 5