[leifj]

DRAFT, not deployed. Step A of the offer-twins removal (the user's plan: flag the base scopes -> move minting -> remove the twins LAST). Base: deploy/gdc-nymauth-verifier (the merged state after #82). Step B is #84 (stacked on this one; do not deploy it before step A has been verified live).

Needs a vc apigw image carrying SUNET/vc#840 (allow_preauth_offer, head 952426dc5), which is in the integration build 015b26efc1b216ada20b1079996f31707837c922 (rebuild in progress; the pin provenance block is updated with the deploy).

What

• issuer.allowPreauthOffer (values-base.yaml, default false; true for gdc in environments/gdc.yaml): chart/templates/04-issuer.yaml renders allow_preauth_offer: true on every datastore scope whose auth_provider is not preauth, never on a preauth scope.
• scripts/datastore.py (offer_scope): make datastore-offer SCOPE=<type> mints against the base scope when the RENDERED apigw config flags it, otherwise against the <type>_offer twin; a named <type>_offer is never rewritten; a twin-style DOCUMENT_ID (document_id_nym_auth_offer_alice-001) is mapped to the base document id (document_id_nym_auth_alice-001). The twins stay in this step, so the Pixel nym_auth rounds keep working with nym_auth_offer until a base-scope offer has been redeemed.

Why gdc can set the flag (the #840 startup guard)

The guard refuses to start unless api_auth.oidc.enable, or api_auth.jwks.enable with the admin UI off. gdc's rendered apigw config: api_auth.jwks.enable: true, oidc.enable not set (false), admin_ui_enable not set (vc default false). Passes; vc was told these values. The flag is off by default because an image with #840 refuses to start with it set where that does not hold, and an older image ignores it (a base-scope mint then fails with invalid_scope).

Tests

tests/test_offer_without_twins.py (8): flag off by default, on for every login-gated scope and never on a preauth one, gdc sets it, and the five offer_scope cases. Proven non-vacuous (making the template always render the flag fails the first two). make vc-config-parity clean (five accepted-diffs entries for gdc's allow_preauth_offer); tests/golden/fly_up.json refreshed. Full suite: only the unrelated 4 test_chat errors.

Deploy order (gdc)

New vc images -> deploy with the flag set -> mint an offer for the BASE scope (make datastore-offer SCOPE=nym_auth DOCUMENT_ID=document_id_nym_auth_alice-001 ENV=gdc) -> redeem it on the Pixel (offer with credential_configuration_id nym_auth; the seed must still be delivered) -> only then step B.

🤖 Generated with Claude Code