Skip to main content

Centralized SSO Token

Implemented as centralized web session via the Mekari Session SDK. Related SSO operational documentation (force-logout handbook, session reference) lives under ../sso.

Initiative owned by the Bifrost team. Replaces per-product web session handling with a single centralized session, integrated through the Mekari Session SDK (@mekari/sdk). Each Qontak web surface — Launchpad, Hub, Hub Chat v2, CRM — consumes the shared session and current-company state instead of managing auth/SSO locally. Driven by the Account & Launchpad squad (SDK / Session Manager owner); Hub, Hub Chat v2, and CRM are integration consumers.

Hard-gate correction (2026-07-20): the SDK is available. Only SB-2's live Session Manager staging endpoint and Infosec's iframe CSP whitelist block the pilot. See status 2026-07-20.

Scope Changes​

  • Frontend — Mekari Session SDK integration across Launchpad, Hub, Hub Chat v2, and CRM web frontends; replacing local auth/SSO/session logic with the shared SDK; current-company sync wiring.
  • Backend — current-company sync support for the Launchpad SDK integration (cross-repo RFC).

RFCs​

The initiative is specified as one authoritative cross-repo RFC plus one per consuming surface. Each RFC has a co-located -review.md (rfc-reviewer report) and .task-breakdown.md.

Phasing​

Chunked into two phases on 2026-07-19 (decision 0002) to relieve the DRI's Q3 FE over-capacity. No scope is cut — the initiative's total stays 37.5 md (FE 23 · BE 4.5 · QA 10); only Phase 2's scheduling window moves to Q4. The initiative remains a single folder / single Epic (BIF-7802); phases are a scheduling split, not a folder split.

PhaseWindowSurfacesEffort (FE/BE/QA)Total
Phase 12026-Q3Launchpad (pilot — Rollout step 4, cross-repo anchor)FE 6.5 · BE 0.5 · QA 2.59.5 md
Phase 22026-Q4CRM · Hub · Hub Chat v2 (step 5 consumers)FE 16.5 · BE 4.0 · QA 7.528 md

Only Phase 1 counts toward the 2026-Q3 capacity plan; Phase 2 is Q4-deferred (excluded from Q3 load, same as an as-built exclusion). Phase 2 is deferred, not dropped — there is no Q4 capacity plan yet, so its staffing/scheduling is picked up in Q4 planning. Pilot ordering is unchanged: Launchpad proves the SDK first, then the step-5 consumers.

QA Lane​

Lane B — keeps a human QA gate. Security/isolation-sensitive: centralized authentication/session and cross-company (current-company) state shared across products; a silent failure could leak or cross sessions between companies. No E2E test specs exist for this initiative yet, so the Lane-A entry bar (100% E2E, spec-mapped coverage) is unmet regardless. Owner/classification: TBD, 2026-06-29.