/journey-auth

name: journey-auth
description: Use as the auth build stage of the Butterbase journey, after journey-schema (and rls if separate). Implements the Auth section of 02-plan.md by delegating to auth-setup. Calls manage_oauth (configure) for providers and optionally manage_auth_config (configure_auth_hook, update_jwt). Skipped if the plan has no end-user auth.

Journey: Auth

Stage 3c of the guided journey. Configure OAuth providers and (optionally) auth hooks.

When to use

• Dispatched by `journey` when `current_stage: auth`.
• Directly via `/butterbase-skills:journey-auth`.
• Skipped (annotated `(n/a)` in `00-state.md`) if the plan has no end-user auth.

Preflight

If `docs/butterbase/03-preflight.md` is missing, older than 24 hours, or `00-state.md` has `app_id: null`, invoke `butterbase-skills:journey-preflight` first. Wait for it to return successfully before proceeding.

Inputs

• `docs/butterbase/02-plan.md` — the Auth section.
• `docs/butterbase/00-state.md` — for `app_id`.

Procedure

0. **Refresh docs.** Call `butterbase_docs` with `topic: "auth"`. For provider-specific setup (Google/GitHub/Apple), also WebFetch `https://docs.butterbase.ai/auth`. Skip if cache is fresh.

1. Read the Auth section of `02-plan.md`. Print it back: `"About to configure auth: providers=<list>, demo_user=<yes/no>. Proceed?"`. Wait for `yes`. 2. Invoke `butterbase-skills:auth-setup` via the Skill tool, passing the Auth plan and `app_id`. The wrapped skill will prompt for each provider's client ID/secret and call `manage_oauth action: configure`. If a demo user is requested, it seeds one via `insert_row` on the users table. 3. After it returns, run `manage_oauth action: get` to confirm and print the redirect URLs the user must register with each provider. 4. Append one line to `docs/butterbase/04-build-log.md`: `<ISO timestamp> auth manage_oauth ok` 5. Tick `- [x] auth` in `00-state.md`, set `current_stage:` to the next unchecked stage. 6. Return to `journey` orchestrator (or ask `"Continue to the next stage? (yes/no)"`).

Outputs

• Configured OAuth providers.
• Optional seed user.
• One line in `04-build-log.md`.

Anti-patterns

• ❌ Echoing OAuth client secrets back to the user.
• ❌ Forgetting to give the user the provider-side redirect URL — auth will silently fail without it.