3 Commits

Include renames

Author	SHA1	Message	Date
ced4568	4c0a950afb	fix: retry Google's transient domain-wide-delegation propagation-delay error ... Live Google Workspace delivery validation surfaced a real, self-resolving Google-side condition: freshly-authorized domain-wide delegation can take up to about a minute to propagate across Google's auth infrastructure, producing intermittent unauthorized_client on the OAuth token exchange even with correct configuration. gws-provider.js now classifies unauthorized_client as a temporary (retryable) error instead of permanent, so the existing bounded-backoff worker absorbs it automatically. Also documents the alias-vs-delegated-user env passthrough in docker-compose.dev.yml, and records both real findings (this one and the GOOGLE_DELEGATED_USER alias distinction) plus the full live-delivery validation outcome in the runbook and Phase 5C doc. Validated live: isolated gws-email-test.js send (DKIM/SPF passing, delivered) and a full real lifecycle test (create student, enrollment, real activation email, activate, login, see program, real password-reset email, reset, login with new password) via [email protected].	2026-08-25 21:36:12 -05:00
ced4568	7baf7074e5	fix(email): support a delegated-mailbox alias distinct from the delegated Workspace account ... Real-world case found during setup: the sending address ([email protected]) is an alias of an existing Workspace user, not its own paid seat (a deliberate cost-saving choice). Domain-wide delegation authorizes a real Workspace ACCOUNT, not an arbitrary alias string, so using the alias directly as the delegated 'sub' claim would have been wrong. Added GOOGLE_DELEGATED_USER (the account that actually owns the alias and was granted delegation) as an optional override, falling back to EMAIL_FROM_ADDRESS unchanged when the sending address is itself a primary account. EMAIL_FROM_ADDRESS remains the visible From: header in both cases. Documented in docs/RUNBOOK_GOOGLE_WORKSPACE_EMAIL.md with a concrete example.	2026-08-25 17:38:59 -05:00
ced4568	777efd168d	docs(phase5c): enrollment communications documentation + Google Workspace runbook ... - PHASE5C_ENROLLMENT_COMMUNICATIONS.md: the full design doc. - RUNBOOK_GOOGLE_WORKSPACE_EMAIL.md: every REQUIRES GOOGLE WORKSPACE ADMIN ACTION step (mailbox, service account, domain-wide delegation scoped to gmail.send only, SPF/DKIM/DMARC), environment variables, testing procedure, production secret handling, rotation, revocation, troubleshooting, quotas. - RUNBOOK_STUDENT_ACTIVATION.md: day-to-day operation of the pipeline from /admin. - WEBSITE_ENROLLMENT_INTEGRATION.md: explicit website-vs-RootNode responsibility boundary, the new contact_email field, and closes the 'RootNode doesn't send activation email yet' known limitation this doc previously documented. - RUNBOOK_SELF_PACED_ENROLLMENT.md, RUNBOOK_STUDENT_ACCOUNT_LIFECYCLE.md: point at the new automatic-email behavior and the Resend activation control. - REMOTE_AND_SELF_PACED_ARCHITECTURE.md, ENGINEERING_SOP.md: close the enrollment- communication gap; new ENGINEERING_SOP §16. - PRODUCTION_VALIDATION_CHECKLIST.md, README.md, platform/README.md: cross-references and a Phase 5C production-validation section.	2026-08-25 14:45:18 -05:00