# Oncall v2 service (migrated from olympus-HA/v2)

This service is migrated into the aisupport monorepo at:
- backend: `services/oncall`
- frontend: `apps/oncall-web`

## Auth0 Toggle By Environment

Auth0 validation can be enabled or disabled per environment using env vars.

Priority:
1. `AUTH0_ENABLED` (explicit override)
2. fallback by env name (`APP_ENV`/`AISUPPORT_ENV`/`ENV`/`GO_ENV`)

Default behavior:
- `APP_ENV` in `dev|development|local|test|testing` -> Auth0 OFF
- other envs (including prod) -> Auth0 ON

Important for shared dev clusters:
- if a deployed `dev` environment is expected to enforce real authentication, set `AUTH0_ENABLED=true` explicitly
- otherwise `APP_ENV=dev` will fall back to auth bypass behavior

Useful vars:
- `ONCALL_DB_DIALECT=sqlite|mysql` (default sqlite)
- `ONCALL_DB_DSN=...` (required for mysql, optional alias for sqlite)
- `ONCALL_DB_PATH=...` (sqlite path fallback)
- `ONCALL_LISTEN_ADDR=:8080` (authenticated API listener)
- `ONCALL_INTERNAL_LISTEN_ADDR=:8081` (optional unauthenticated internal listener)
- `AUTH0_ENABLED=***`
- `APP_ENV=dev|prod`
- `AUTH0_DOMAIN=***`
- `AUTH0_CLIENT_ID=***`
- `DEV_BYPASS_USER_EMAIL=<email>` (identity used when Auth0 validation is disabled; must be set explicitly when `DEV_BYPASS_AUTH=true`)

## Optional EKS-internal listener

Set `ONCALL_INTERNAL_LISTEN_ADDR` to start a second HTTP listener with the same
API routes but without credential validation. For example:

```text
ONCALL_LISTEN_ADDR=:8080
ONCALL_INTERNAL_LISTEN_ADDR=:8081
```

The internal listener must only be exposed through a ClusterIP service and must
not be attached to an Ingress. `X-User-Email` and `X-Operator` are accepted as
unverified caller identity for existing business-permission and audit fields. If
they are omitted, the request uses `oncall-internal@pingcap.com`.

Examples:
- Dev (Auth0 off):
  - `APP_ENV=dev`
  - `AUTH0_ENABLED=false` (optional, explicit)
- Dev cluster (Auth0 on):
  - `APP_ENV=dev`
  - `AUTH0_ENABLED=true`
  - `DEV_BYPASS_AUTH=false`
- Prod (Auth0 on):
  - `APP_ENV=prod`
  - `AUTH0_ENABLED=true`

## Dev Deploy Smoke Auth

The GitHub Actions workflow `deploy-oncall-dev.yml` now validates deployed endpoints with a real bearer token instead of `X-User-Email`.

Required repo secret:
- `ONCALL_V2_DEV_SMOKE_BEARER_TOKEN`

Recommended value:
- a stable dev API key created for a smoke-test user, sent as `Authorization: Bearer <token>`

This keeps dev smoke aligned with actual backend authentication when `AUTH0_ENABLED=true`.

## Local run

Backend (port 18080 by default):
- `scripts/bootstrap/run-oncall-backend-dev.sh`

Frontend (CRA dev server on 3000, API defaults to http://localhost:18080):
- `scripts/bootstrap/run-oncall-web-dev.sh`

Or manually:

```bash
cd services/oncall
cp .env.dev.example .env.dev
set -a && source .env.dev && set +a
go run .
```

```bash
cd apps/oncall-web
npm install
REACT_APP_ONCALL_API_BASE=http://localhost:18080 npm start
```