GeoSync Phase 1A — Staging QA

Central SSO with compat $_SESSION[qz_user] hydration. No project ACL, no Go changes.

Prerequisites

1. Run sql/001_geosync_user_bridge.sql on GeoSync DB (qzs).
2. Run sql/002_geosync_service_resource.sql on Central DB (acugis_meta).
3. Configure PHP environment (see deploy/geosync-auth.env.example):
4. GEOSYNC_AUTH_MODE=central
5. CENTRAL_DATABASE_URL=postgresql://...
6. CENTRAL_LOGIN_URL=/login
7. CENTRAL_LOGOUT_URL=/logout
8. GEOSYNC_BASE_PATH=/geosync (when mounted under subpath)
9. Ensure test user is in Central Administrators group (only group seeded with geosync service admin in 1A).
10. Document one break-glass local account in public.user; set GEOSYNC_AUTH_MODE=local to use legacy login.

Rollback (instant)

GEOSYNC_AUTH_MODE=local

Reload PHP-FPM. No schema rollback required.

Test checklist

#	Case	Expected
1	Open /geosync/admin/projects.php without acugis_session	Redirect to /login?next=...
2	Log in at Central as Administrator	Can open GeoSync admin UI
3	Central user in Editors only (no Administrators)	403 Permission denied (Editors not granted in 1A)
4	First login	Row in geosync_user_bridge; public.user Admin with owner_id = id; auth_source = central_sso if columns exist
5	Second request	Same qz_user->id; no duplicate users
6	index.php dashboard	Projects/groups scoped as before
7	POST admin/action/project.php	JSON success when owned
8	/geosync/logout.php	Redirect to Central logout; GeoSync requires login again
9	/geosync/login.php	Redirect to Central (no local form)
10	POST admin/action/login.php	Redirect to Central (not 404/error)
11	signup.php, registration.php, verify/signup actions	403 Registration disabled
12	/geosync/formbuilder/, /geosync/analysis/	Load when session valid
13	/geosync/api/proxy.php	401 without session; works with session
14	GEOSYNC_AUTH_MODE=local	Legacy email/password via login.php works

Manual includes (no auto_prepend)

Bootstrap is wired via:

require_once .../incl/geosync_auth_prepend.php on:

• index.php
• admin/*.php
• admin/action/*.php (except login.php — public redirect only)
• formbuilder/index.php, analysis/index.php, api/proxy.php

After staging sign-off, optional migration to auto_prepend_file.

Known limitations (1A)

• Service ACL: Administrators → geosync admin only (no Editors).
• No per-project Central ACL.
• FormBuilder/Analysis still trust PHP perimeter; X-User-ID unchanged.
• Keycloak PHP mode still exists but is superseded by central in production.

Debug

• Missing Central DSN → 503 Central authentication store unavailable.
• Valid session, no service grant → 403 Permission denied.
• Bridge/JIT failure → 500 Failed to provision GeoSync user.