fix(phase6): repair tenant auth ticket exchange and custom-token handoff

[spandreou]

Summary

Resolves the root cause of the tenant Auth Broker handoff failure on Production during exchangeAuthTicket.

Root Cause Investigation

1. Production Cloud Run logs for exchangeauthticket at 2026-09-05T15:11:43.562854Z proved:
   • createAuthTicket: HTTP 200 SUCCESS
   • exchangeAuthTicket: HTTP 500 FAILURE at stage custom_token_creation (getAuth().createCustomToken(...))
   • Exact error: Unhandled error FirebaseAuthError: Permission 'iam.serviceAccounts.signBlob' denied on resource
   • Runtime service account 978890379614-compute@developer.gserviceaccount.com lacked roles/iam.serviceAccountTokenCreator to sign custom tokens via IAM Credentials API.
2. IAM Remediation applied: Granted roles/iam.serviceAccountTokenCreator to 978890379614-compute@developer.gserviceaccount.com on project gasstationproject-9dd89 and on the service account resource itself.
3. Client Callback Enhancement: Updated src/components/auth/AuthTicketCallback.jsx to cleanly distinguish BROKER_EXCHANGE_* from CUSTOM_TOKEN_SIGNIN_* errors.
4. Function Diagnostics: Added structured stage diagnostics and error logging to exchangeAuthTicket in functions/src/index.js matching createAuthTicket.

Verification

• npm run qa:auth-broker PASS
• npm run qa:auth-broker-negative PASS (16 tests)
• npm run qa:multi-tenant PASS (7 tests)
• npm run qa:tenant-authorization PASS
• npm run qa:saas-foundation PASS
• npm run qa:phase5-portal PASS
• npm run qa:central-portal-isolation PASS
• npm run qa:product-terminology PASS
• npm run qa:vercel-spa-routing PASS
• npm run security:hardening PASS
• npm run security:integrity PASS
• npm run security:audit PASS (0 high/crit)
• npm run build PASS (2.90s)

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
shiftoryx	Ready	Preview	Sep 5, 2026 3:32pm UTC