Migrate authentication off Auth0 to native Symfony auth

[JanMikes]

Goal

Migrate authentication fully off Auth0 (free tier) to native Symfony 8 authentication — own login/registration/password-reset/email-verification, no external identity provider, no vendor lock-in on password hashes.

Full research & plan: docs/features/auth-migration/

• README.md — analysis, target architecture, decisions D1–D12, risk register
• implementation-plan.md — step-by-step phases 0–7 incl. cutover runbook
• communication-plan.md — user comms timeline, email/banner/FAQ copy, support playbook

Key verified facts (2026-07-11)

• Production: 9,953 players, 100% auth0| email+password — zero social logins (~3,300 active/90d). No social-identity portability problem exists.
• Password hashes are exportable: one month of Auth0 B2C Essentials (~$35, monthly self-service, cancelable) + support ticket → NDJSON with bcrypt $2b$10$ hashes. Verified password_verify() on PHP 8.5 accepts them; Symfony migrate_from: ['bcrypt'] transparently upgrades to argon2id on first login → users keep their exact passwords.
• Free fallback: ROPG "trickle" against Auth0's token endpoint inside our login authenticator covers stale hashes / post-export signups during the transition window.
• Blast radius is contained: Player.userId string is the identity seam (kept as-is), RetrieveLoggedUserProfile is the single read chokepoint, 46 #[CurrentUser] type-hints are a mechanical sweep, tests funnel through 2 helpers. API/PAT/OAuth2-server/admin/Stripe/Mercure untouched.
• All reset/verification UX is a new build (currently 100% delegated to Auth0 hosted pages). Ship magic login links at launch — main mitigation for password managers having credentials saved under *.auth0.com.

Phase checklist

• Phase 0 — Preparation & data (free bulk export, reconciliation of 7 dup-email pairs + 3 missing emails, deliverability check, ROPG smoke test)
• Phase 1 — Paid hash export (~$35 Essentials month + support ticket, validate, downgrade)
• Phase 2 — Build native auth (UserAccount entity, authenticator with trickle branch, registration/reset/verify/login-link, code sweep, tests)
• Phase 3 — User communication (T-14d announcement, banner, FAQ)
• Phase 4 — Cutover (fresh delta export, import, session flush, smoke tests, 48h watch)
• Phase 5 — Transition window (metrics, straggler nudge, exit criteria)
• Phase 6 — Decommission (remove trickle + auth0/symfony fork, delete tenant, privacy policy, secure-delete exports)
• Phase 7 — Optional: passkeys, 2FA, session management

Estimated: ~6–8 weeks calendar (dominated by comms lead time + transition window).

🤖 Generated with Claude Code

[JanMikes]

2026-07-23: Decisions locked, plan refreshed (026a5be) — implementation starting.

Key changes to the plan:

• D14 — staged rollout (new idea, changes the sequencing): Stage A flips registrations to native and disables Auth0 signups; Essentials is paid + the hash-export ticket opened the same day → the single export covers 100% of Auth0 users, no snapshot gap. Stage B flips login ~1 week later (export-gated, hard trickle-primary gate at A+14d).
• D15: one-time explainer modal on the login page (localStorage) + site banner + FAQ.
• D16: layered transparency — simple short-form copy, honest full story (unmaintained SDK fork, rejected upstream fixes) in the FAQ.
• D17: all 6 locales for auth-facing UI.
• New password-manager-shock UX funnel (README): announcement tip → modal → prominent sign-in-link → login-failure helper → post-magic-link set-password prompt → natural manager re-save.
• Inventory delta folded in: Add change password feature via Auth0 password reset email #161 change-password-via-Auth0 is a new touchpoint to swap at Stage B (sweep is now 50 files), lily-era runbooks, Make anonymous HTML responses shared-cacheable (fixes #139) #164 anonymous-cacheability as a hard constraint.

Compressed calendar: Stage A ~Jul 29–31 · Stage B ~Aug 6–12 · decommission ~Sep 8–15.

🤖 Generated with Claude Code