Deployment-context security

The customer portal reads deployment settings at startup, before normal navigation begins. It uses a signed static file and live context from GET /v1/deployment/context.

The static file identifies the deployment and its setup state. Those values are public; the signing key is not.

Security properties

• The static schema requires deployment identity, mode, environment, setup state, version, update time, and signature.
• Portal startup validates the required fields before normal routing.
• The backend setup workflow remains the authority for setup actions.
• A frontend value does not grant permission to create or change an administrator.
• Completed setup must remain completed during API or identity-provider failure.

Validate these cases

Include these states in deployment validation. Record the routing result and whether the backend permits a setup action.

• Static and live context both report completed setup.
• A new environment permits an authorized setup action.
• The static file is missing, malformed, or has an invalid signature.
• Static and live context disagree.
• The customer API is unavailable.
• An unauthenticated visitor opens /setup directly.
• An authenticated user opens /setup after setup is complete.

An outage must not reopen completed setup. A redirect alone is not proof that backend authorization blocked a request.

Key handling

Keep the signing key in the release-approved secret store. Limit access to the service or deployment workflow that creates the signed context.

Do not embed the signing key in JavaScript, the static JSON file, build output, or client configuration.

For operational steps, see Deployment context.