AUTH-002A — Retire the legacy static-key membership sync before manual onboarding

[daliu]

Officer impact: Officers will no longer rely on the old spreadsheet script or a shared API key to grant website membership. The supported initial path will be the explicit, audited website workflow in #115.

Officer documentation: Update OFFICER_START_HERE.md, docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/ACCESS_CONTINUITY.md, and the applicable system/data-flow diagram when the legacy path is removed. Mark #115 NOT AVAILABLE YET until its deployment is proven.

Deployment evidence: None at issue creation. Closure requires a private owner inventory of any Apps Script trigger/caller, source/tests merged, Firebase deployed, old endpoint/config proven absent, any real legacy credential revoked privately, and the replacement officer path independently verified. A source deletion alone is not live proof.

Problem

The repository contains a legacy Google Apps Script and public HTTP Function intended to batch-grant membership by email using one shared static key. The script is hardcoded to an old Sheet tab, contains a placeholder credential, uses query/body fields while the server now accepts only X-API-Key, marks selected rows inserted too broadly, creates no Auth account/member profile, and has no actor identity, stable command ID, replay protection, or durable audit.

Firebase functions.config() is deprecated, and the endpoint cannot safely represent annual paid membership. Current direction is to import later and use deliberate one-at-a-time officer onboarding first.

Atomic outcome

After an authorized owner proves whether any scheduled/live caller still exists and the applicable cutover condition below is satisfied, remove the legacy script/exported endpoint and revoke its configuration/credential. Preserve only redacted migration-history documentation; do not replace it with another shared secret or build bulk import here.

Scope

• Privately inventory Apps Script projects, installable/time triggers, deployment owners, invocation logs/counts, and any configured API key existence only.
• Confirm whether any club process depends on the endpoint and define the cutover/rollback window.
• Remove updateMemberRole from the deployed Functions export and delete or clearly retire the obsolete repository script after preserving non-sensitive history.
• Remove the legacy functions.config().api.key dependency and related examples/docs.
• Revoke/delete the actual key/config privately if it exists; never paste, print, log, export, or commit it.
• Update officer guidance to use MEMBERS-ADMIN-001 — Add audited officer membership association and manual activation #115 for manual onboarding and BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113 for later import decisions.
• Add tests/guards proving no public static-key batch role mutation remains.

Acceptance criteria

• Primary and backup owners confirm every known Apps Script trigger/deployment/caller disposition with private evidence.
• No public HTTP endpoint authenticated only by a shared static key can grant or revoke membership/custom claims.
• The repository/deployed Functions no longer export the legacy endpoint or depend on functions.config().api.key.
• Any live credential/config is privately revoked and a negative endpoint probe confirms the retired route is absent/generic without exposing configuration.
• Removing the endpoint cannot strand an active process: the approved MEMBERS-ADMIN-001 — Add audited officer membership association and manual activation #115 path is deployed and backup-officer tested, or the owner records an explicit time-bounded transition/rollback plan.
• No email list, Sheet/Form locator, trigger details, credential, raw error, or member result is published in issues/logs/tests.
• Historical import remains deferred. No BACKEND-002, Auth account creation, or bulk role grant is added here.
• Officer docs distinguish source removal, Firebase deployment, external trigger removal, credential revocation, and replacement-workflow verification.

Dependencies and coordination

• This is the first atomic child of the catalogued AUTH-002 tracker; it retires the unsafe path and does not implement future bulk import.
• AUTH-002A — Retire the legacy static-key membership sync before manual onboarding #117 does not block MEMBERS-IDENTITY-001 — Define authoritative membership and external-account state #81, MEMBERS-DUES-001 — Build server-authoritative annual membership checkout and renewal #114, or implementation of MEMBERS-ADMIN-001 — Add audited officer membership association and manual activation #115. Before the legacy endpoint/configuration is actually retired, require exactly one cutover condition: (a) MEMBERS-ADMIN-001 — Add audited officer membership association and manual activation #115 is deployed and backup-officer tested when an active process depends on the legacy path, or (b) authorized owners record private no-caller evidence plus an approved cutover/rollback window permitting earlier retirement.
• BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113 owns legacy data/source disposition and gates any later migration/import ticket.
• MEMBERS-IDENTITY-001 — Define authoritative membership and external-account state #81 and the relevant MEMBERS-DUES-001 — Build server-authoritative annual membership checkout and renewal #114 contract child own membership/term/payment-evidence state. AUTH-002A — Retire the legacy static-key membership sync before manual onboarding #117 consumes that contract only for cutover documentation; it does not define membership state and does not block those issues. AUTH-001A — Reject unverified targets at existing role-grant endpoints #98/AUTH-001 verified-email controls must be live-proven; AUTH-003/ADMIN-001 own scoped operator authorization/audit.
• CI-001 — Establish trustworthy quality gates and protected deployment #105 owns backend deployment authority and proof. Coordinate any overlapping Functions index/config work; do not mix this with SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99–CI-001A — Repair the deterministic frontend test baseline #103 claimed files.

Explicitly out of scope

• A replacement importer, Google Sheets/Drive API integration, automatic email association, or bulk role changes.
• Membership schema, annual dues/payment flow, manual association UI, roster export, or provider provisioning.
• Real production data, credential disclosure, direct role edits, or unapproved external configuration changes.

Claim protocol

Creation is not a claim. Do not edit files until dependencies are complete, the issue is assigned, and a timestamped CLAIMED by <canonical agent> at <UTC>; branch <branch> comment is posted and re-read. Earliest valid claim wins. Trigger inventory and credential/config revocation are owner-only actions requiring private evidence.

[daliu]

COORDINATION EDIT STARTED by Codex agent /root/membership-access at 2026-07-13T06:35:55Z. This is not an implementation claim. I am correcting only the circular dependency direction among #81, #115, and #117; product scope and status labels remain unchanged.

[daliu]

COORDINATION EDIT COMPLETE at 2026-07-13T06:37:39Z. #117 no longer blocks #81/#114/#115. Retirement waits for either a deployed replacement when a caller exists or authorized private no-caller evidence plus an approved cutover/rollback window. Status stays proposed and needs-external-config; this is still unassigned and unclaimed for implementation.