EVE SSO
EVE SSO Readiness
WarpIntel keeps public tools usable without sign-in, limits first login to publicData, and asks for private EVE scopes only when a feature needs them. This page exposes the public readiness gate, consent-preview routes, and safety counts without exposing client IDs, client secrets, tokens, account records, or private EVE data.
EVE sign-in is feature-flagged off until the production callback is confirmed and a test sign-in succeeds.
Public identity only; private wallet, asset, location, skill, and corporation data stay feature-gated.
Preview-only feature consent bundles are staged before any CCP redirect starts.
Only safe setup status is shown; secret values and provider-console state are excluded.
OAuth is blocked before state cookies and the CCP redirect unless the production callback matches.
Every live-login prerequisite is tracked as public-safe evidence before sign-in is exposed.
First-login review steps keep callback, scope, credential, and tracker decisions explicit.
Wrong account, callback drift, or unexpected OAuth behavior has a defined stop path.
Production Callback
Public callback expected by WarpIntel:https://warpintel.app/api/auth/eve/callback
EVE sign-in remains hidden until the feature flag, runtime credentials, production callback, first-login scope, and final live sign-in test are ready.
Runtime Login Callback Gate
The login route can pass the callback gate after the other feature, credential, and scope checks are ready.
- Before State Cookie
- Blocked on mismatch
- Before CCP Redirect
- Blocked on mismatch
Production Callback Exact Match
EVE login cannot be exposed until the EVE Developer Portal callback exactly matches the public WarpIntel callback.
- Evidence
- https://warpintel.app/api/auth/eve/callback
Runtime Credentials Present
The app only reports whether credentials are present; client ID and client secret values stay excluded.
- Evidence
- runtime presence only
publicData First Login
First sign-in stays limited to public identity before feature-specific private ESI permissions are requested.
- Evidence
- publicData
Feature Consent Previews
Each private-data feature has a preview path so users can review requested scopes before OAuth starts.
- Evidence
- 8 preview-only feature consent plan(s)
Runtime Login Guard
The login route stays inside WarpIntel before OAuth state cookies or CCP redirects when the production gate is not ready.
- Evidence
- OAuth blocked before state and provider redirect
Protected Review Packets
Protected admin packets cover setup and dry-run review without returning credentials, tokens, account data, or private EVE data.
- Evidence
- /api/admin/eve/setup-packet and /api/admin/eve/dry-run
Live Smoke Routes
Production smoke covers the safe EVE auth boundary routes, including state failure, without exchanging tokens.
- Evidence
- /api/health, /api/auth/eve/readiness, session, login gate, consent preview, callback state failure
WarpIntel Account Boundary Review
Confirm the EVE Developer application, callback, and credentials belong to WarpIntel only and no separate-project account is used.
- Owner
- project-owner
- Evidence
- EVE Developer Portal application review
Callback And Domain Review
Confirm the production callback exactly matches https://warpintel.app/api/auth/eve/callback before OAuth can start.
- Owner
- operator
- Evidence
- protected setup packet
Credential Storage Review
Confirm client credentials are stored only in protected project systems and are never copied into chat, logs, docs, screenshots, or public pages.
- Owner
- operator
- Evidence
- protected credentials and environment review
First Login Scope Review
Confirm first sign-in asks only for publicData and private feature scopes remain user-consent gated until the feature needs them.
- Owner
- project-owner
- Evidence
- consent preview
Controlled Login Smoke Review
Run one controlled production publicData sign-in test after the feature flag is enabled and verify public health stays no-secret.
- Owner
- build-team
- Evidence
- production live sign-in test notes
Tracker Record
Record only secret-free commit, deployment, callback, scope, and smoke outcomes in the WarpIntel tracker.
- Owner
- operator
- Evidence
- project tracker
Wrong EVE App Or Account
Wrong account or application state stops activation before users can start OAuth.
Callback Or Scope Drift
Callback or first-login scope drift rolls the lane back to preview-only consent review.
Unexpected OAuth Or Private Data Exposure
Unexpected OAuth, token, or private-data exposure returns EVE SSO to the locked public readiness state.
EVE Sign-In Feature Flag
Public sign-in is hidden until the production callback is confirmed.
Feature Scope Coverage
9 of 10 permission groups are fully allowed in the runtime scope list.
Identity
Public Identity: 1/1 scope(s) allowed.
Contacts
Contacts And Standings: 5/5 scope(s) allowed.
Skills
Skills And Fit Readiness: 5/5 scope(s) allowed.
Audit
Character Audit Profile: 9/9 scope(s) allowed.
Market
Personal Market And Industry: 8/8 scope(s) allowed.
PI
Planetary Industry Colonies: 1/1 scope(s) allowed.
Fleet/SRP
Fleet And SRP Context: 5/5 scope(s) allowed.
Corp Ops
Corporation Operations: 15/15 scope(s) allowed.
Corp Gov
Corporation Governance: 6/6 scope(s) allowed.
Actions
Optional Write Or Client Actions: 2/8 scope(s) allowed; 6 still gated.
Pilot Dashboard And Saved Reports
/dashboard: 1 scope(s).
Fit Lab Skill Readiness
/fit-lab: 5 scope(s).
Character Audit
/character-audit: 22 scope(s).
Market, Industry, And Assets
/market: 8 scope(s).
PI Colony Planning
/pi: 1 scope(s).
Fleet And SRP Proof Context
/srp: 5 scope(s).
Corporation Command Center
/corp-audit: 21 scope(s).
Optional Fleet And Client Actions
/fleets: 13 scope(s); 8 high-trust; 8 write/action.
No-Secret EVE SSO Rule
Public EVE gate health exposes status booleans, safe counts, permission-group coverage counts, preview-only feature consent metadata, activation criteria, owner-handoff counts, owner proof-target counts, rollback decision counts, the expected callback, and runtime login guard state only; it never exposes client IDs, client secrets, EVE tokens, account data, or private EVE data.