[gustavomarques00]

Summary

• Explicit extension grant scopes. Contacts require a confirmed reconnect mint. Legacy grants keep profile/jobs/applications only.
• Bearer checks enforce scopes. The new mint always writes the validated list and does not rely on the database default.
• Follow-up migration 20261020210000_extension_grant_scopes_legacy_default sets DEFAULT to that same legacy set so the pre-scopes writer, which omits scopes, can still insert.
• That DEFAULT is write compatibility only. It does not make the old binary enforce scopes.

Why the first migration file was not edited

• 20261020140000_extension_grant_scopes is already recorded in the local ApplyFlow Postgres on 127.0.0.1:5434. That database was not reset.
• The file is not on origin/main or origin/production.
• Shared remote databases were not queried. Because that cannot be confirmed, the applied migration history is preserved and the DEFAULT is a new migration.

Migration order

1. 20261020140000_extension_grant_scopes — add scopes, backfill legacy scopes only, NOT NULL. No contacts.
2. 20261020210000_extension_grant_scopes_legacy_default — DEFAULT of the same legacy set. No contacts.
   Both must be applied before the production push of the app that selects scopes. Neither migration was applied remotely by this PR.

Launch plan and approvals

These are separate approvals. None of them is granted by this update.

1. Merge feat(applyflow): explicit extension grant scopes for contacts (PR1) #262 into main. Integrates code. ApplyFlow (devflow-applyflow, production branch production) gets a preview only. Portal, WhatsApp, and Financeiro use production branch main, so the merge is a production git event for those projects. The ApplyFlow preview has no DATABASE_URL and does not prove persisted routes.
2. Remote migration. Apply both migrations to the production database before the push that promotes this code onto production. Do not edit or reapply 20261020140000 if it is already present; apply only the pending DEFAULT migration. This approval does not publish the new binary and does not change flags.
3. Promote production. Fast-forward only after the migrations are applied and the full commit list is reviewed again. Today, origin/production..origin/main is portal-only (0a56b491, f2113384, 7e5fe247, cc8c47bb, afb5cd2e, 160ee4d7, fbcbbc8c). After this PR merges, the same promotion also includes 23d5b284, 8dc2192e, ec8332e3, and f8b0e100. The Vercel project that deploys production from branch production is devflow-applyflow only. The git ref is not an ApplyFlow-only history.

Failure of the first scopes deployment

There is no production deployment that already enforces scopes. dpl_7AEKoUVxHRLf7bzLiZzzx7B16K5d (ab1c04caa1f2) is not a rollback target. Fix-forward with a build that still enforces scopes is recovery, not rollback. The current flag value was not reconfirmed and is not a guaranteed block. Any flag change or other remote containment needs its own approval.

Tests on this HEAD

• Disposable Postgres 127.0.0.1:5439/applyflow_scopes_check (removed after the run). Existing 127.0.0.1:5434/applyflow was not reset.
• Prior migrations, then an old INSERT, then 20261020140000: existing grant received only legacy scopes.
• After 20261020210000, an INSERT that omits scopes received only legacy scopes.
• Explicit mint and session POST with the confirmed list stored contacts:read and contacts:write.
• Legacy bearer on GET /api/applyflow/v2/contacts returned 403 grant_capability_denied.
• Invalid scopes were rejected with 400 and did not insert a grant.
• Unit tests for grant scopes/guard/contacts passed.
• prisma generate hit a local file lock (EPERM renaming the query engine). Schema load started; CI generate is still required.

E2E limits from the previous HEAD

The earlier browser E2E (ec8332e3) is not re-run here. This change does not alter extension runtime behavior. Service-worker restart in that run was CDP stopAllWorkers, not a full browser restart.

Out of scope

No merge, remote migration, production promotion, or flag changes. PR 2 is not started.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
devflow	Ready	Preview	Oct 21, 2026 12:11am UTC
devflow-applyflow	Ready	Preview	Oct 21, 2026 12:11am UTC
devflow-financeiro	Ready	Preview	Oct 21, 2026 12:11am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
devflow-whatsapp	Ignored	Preview	Oct 21, 2026 12:11am UTC