ClubSpark Classic Auth — Stage/Test post-deployment validation

Captured: 2026-07-10 (after rolling the new identity-platform code forward to stage/test) · Harness: pw-harness (Playwright) · Compare to: pre-rollout baseline

Re-run of the same sign-up / sign-out / sign-in commands as the strengthened pre-rollout baseline, against the deployed build, to surface regressions and improvements. Every step is checked for its final destination (did it return the user to the venue?) and captured as a landing-page screenshot, shown baseline vs post-deploy side by side below.

Baseline → post-deploy diff

Legend: ✅ pass · ❌ fail · ⛔ blocked (external) · ➖ n/a

# Domain Baseline Post-deploy Δ
1 stg-solo-web.clubspark.io/ 10/10 ✅ 10/10 ✅ — no change
2 stg-solo-web.clubspark.io/RITUVENUES/ 10/10 ✅ 10/10 ✅ — no change
3 stg-solo-custom.clubspark.ninja/ 10/10 ✅ 10/10 ✅ — no change
4 tst-fa-web.clubspark.io/ (FA→B2C) 5/7 (signin stalled) 8/8 ✅ 🔼 signin FIXED — completes MFA + Your Details (agrees T&C) → venue home; sign-out now via Duende /Account/Logout — see §4
5 stg-ecb2-web.clubspark.io/ (ECB→Okta) 7/7 ✅ 7/7 ✅ — no change
6 stage-lta.clubspark.io/ (LTA) ⛔ signup (reCAPTCHA) ⛔ signup (reCAPTCHA) — not re-validated (external, unchanged)
7 stg-fa-web.clubspark.io/ (FA→B2C) 5/7 (QA tenant, wrong tst RP) 7/7 ✅ 🔼 RP repointed + fully working on the stage FA B2C (login-stg.thefa.com) once a name-free password is used — see §7
8 tst-fa-web…/NewburyFC/Coaching/…?campaign=… (FA venue deep link) ➖ new 8/8 ✅ 🆕 added to check logout from a venue/campaign deep link — lands on a branded “signed out” page (≠ the root Duende logout) — see §8

Headline: FA now works end-to-end on both tst-fa-web (§4, 8/8) and stg-fa-web (§7, 7/7). tst-fa sign-in, which stalled at the baseline, completes email-MFA, fills the Your Details form (agreeing to the T&C) and returns to the venue home; stg-fa has been repointed off the QA tenant onto the stage FA B2C (login-stg.thefa.com) and now signs up + in + out cleanly. No regressions on solo (§1–3) or ECB (§5). One thing to watch (not a failure): tst-fa sign-out lands on the Duende /Account/Logout page rather than the venue — stg-fa sign-out returns to the venue, so the difference is environment config (see below).

Harness fix that unblocked §7: the generated password used to embed the account’s surname (Cs<Surname>!…). The QA tenant accepted it, but the stage FA tenant rejects name-bearing passwords — so sign-up was stuck on the password step. The harness now generates a name-free passphrase (e.g. bocifa4-tuketo-Rilupa); solo / ECB / tst-fa are unaffected (re-verified), and stg-fa sign-up now completes.

👀 Watch-item: tst-fa sign-out lands on the Duende logout page

At the baseline, tst-fa sign-out returned to the venue home. Post-deploy it lands on the Duende IdentityServer page tst-solo-ids-sts.clubspark.io/Account/Logout — “Logout — You are now logged out” — with generic Clubspark STS chrome and no link back to the venue. The harness treats this as a valid sign-out confirmation (session is cleared) so it’s a pass, but the destination changed.

This is environment-specific: stg-fa sign-out (§7) returns cleanly to the venue home, so the two FA environments differ. That points at the tst Duende client missing the post_logout_redirect_uri (and/or a branded logout page) that stg has — worth aligning tst to stg.

tst-fa — baseline (venue) tst-fa — post-deploy (Duende logout) stg-fa — post-deploy (venue)

How to reproduce

CS_BASE=https://stg-solo-web.clubspark.io/            CS_LEGACY_AUTH_HOST=stg-solo-auth.clubspark.io node test-legacy-auth.mjs 1   # §1 → 10/10
CS_BASE=https://stg-solo-web.clubspark.io/RITUVENUES/ CS_LEGACY_AUTH_HOST=stg-solo-auth.clubspark.io node test-legacy-auth.mjs 1   # §2 → 10/10
CS_BASE=https://stg-solo-custom.clubspark.ninja/      CS_LEGACY_AUTH_HOST=stg-solo-auth.clubspark.io node test-legacy-auth.mjs 1   # §3 → 10/10
node fa-suite.mjs https://tst-fa-web.clubspark.io/ 1                                                                               # §4 → 7/7 ✅
CS_BASE=https://stg-ecb2-web.clubspark.io/ node test-ecb-auth.mjs 1                                                                # §5 → 7/7
node fa-suite.mjs https://stg-fa-web.clubspark.io/ 1                                                                               # §7 → 7/7 ✅
node fa-suite.mjs "https://tst-fa-web.clubspark.io/NewburyFC/Coaching/Summary/97c1c2cd-0612-4b1e-ba79-1ec6d53c8ebe?campaign=KickaboutColleges" 1   # §8 → 7/7 ✅

Each step’s landing screenshots below come from these runs (CS_LANDING_DIR set). Tables read scenario (row) × baseline / post-deploy (column).

§1–3 · Solo / Independent — ✅ unchanged (10/10 each)

Legacy WS-Fed, self-serve; all three land correctly on every action (sign-out on the sub-venue / custom domain shows the expected “You have been signed out” page — a pass). No change from baseline.

§1 · stg-solo-web (top-level)

step baseline post-deploy
after sign up
after sign out
after sign in

Videos: baseline · post-deploy

§2 · /RITUVENUES (sub-venue)

step baseline post-deploy
after sign up
after sign out
after sign in

Sign-out lands on the expected “You have been signed out” page (sub-venue). Videos: baseline · post-deploy

§3 · stg-solo-custom.clubspark.ninja (custom domain)

step baseline post-deploy
after sign up
after sign out
after sign in

Sign-out lands on the expected “You have been signed out” page (custom domain). Videos: baseline · post-deploy

§4 · tst-fa-web (The FA) — 🔼 sign-in FIXED

Baseline: 5/7 — sign-in stalled on the B2C FA app-token step and never returned. Post-deploy: 8/8 — sign-in completes email-MFA, then the standard Your Details form appears (B2C didn’t carry a full profile); the harness fills the missing fields, agrees to the Terms & Conditions, and lands logged-in on the venue home. Sign-up still returns to FA’s own RP by design (INFO). Sign-out now lands on the Duende /Account/Logout page (see watch-item).

step baseline post-deploy
after sign up
➖ FA’s own RP (by design)
➖ FA’s own RP (by design)
after sign out
✅ venue
⚠️ Duende /Account/Logout
after sign in (lands on Your Details)
❌ stuck on B2C (never reached the venue)
ℹ️ Your Details form (fills missing fields + agrees T&C)
→ after Your Details ➖ n/a (baseline stalled on B2C first)
✅ venue home (logged in) — got past Your Details

Videos: baseline signin+signout · post-deploy signin+signout

§5 · stg-ecb2-web (ECB) — ✅ unchanged (7/7)

Signup / signin / signout all land on the venue (/AllStars/Search). No change from baseline.

step baseline post-deploy
after sign up
after sign out
after sign in

Videos: baseline · post-deploy

§7 · stg-fa-web (The FA) — ✅ now fully working on the stage FA B2C

Baseline: 5/7 — federated to the QA tenant (b2cqathefa) + wrong tst RP. Post-deploy: 7/7 — federates to the stage FA B2C (login-stg.thefa.com, tenant b2cppthefa) and completes sign-up → sign-in → sign-out. Sign-in returns to the venue home (logged in); sign-out returns to the venue. The only change needed was a name-free password (the stage tenant rejected the surname-bearing one — see the headline note). Sign-up is slow on this tenant (~several minutes on the password step) but completes.

step baseline (QA tenant, wrong RP) post-deploy (login-stg.thefa.com)
after sign up
❌ password rejected
✅ created → FA’s own RP
after sign out
✅ venue
✅ venue
after sign in
❌ no account (“email or password do not match”)
✅ venue (logged in)

Videos: post-deploy signup (long — slow stage tenant) · post-deploy signin+signout

§8 · tst-fa-web venue deep link + campaign — logout behaviour

Added to answer a specific question: what does logout do from a real venue / campaign deep link? Target: tst-fa-web.clubspark.io/NewburyFC/Coaching/Summary/97c1c2cd-…?campaign=KickaboutColleges. Result: 8/8 — sign-up → sign-in (incl. completing Your Details) → sign-out all complete and the session clears.

Logout finding: sign-out from this venue deep link routes through the legacy WS-Fed sign-out on tst-solo-auth (/account/signin?ReturnUrl=…wa=wsignout1.0…) and lands on a branded “You have been signed out / Sign back in” page — England Football header, Newbury Football Club footer. The session is fully cleared (returning to the deep URL shows anonymous), but the user is not auto-returned to the campaign page — they get the sign-out confirmation.

This differs from the root tst-fa sign-out, which lands on the bare Duende /Account/Logout page (generic Clubspark chrome, no branding). So a venue / deep-link sign-out gets the good branded page; the root gets the Duende page — same site, two routes:

root tst-fa sign-out (Duende /Account/Logout) venue deep-link sign-out (branded WS-Fed)

Per-step landings for this deep link (post-deploy run):

step landing
after sign up
➖ FA’s own RP (by design)
after sign out
✅ branded “You have been signed out” (Newbury FC)
after sign in (lands on Your Details)
ℹ️ /NewburyFC/Account/YourDetails — fills missing fields + agrees T&C
→ after Your Details
✅ venue (logged in) — got past Your Details

Videos: signup · signin+signout

Note — deep-path / campaign preservation on sign-in. The suite creates a fresh account each run, so first sign-in shows the standard Your Details form (profile completion); the harness fills it, agrees to the T&C, and lands on the venue home — confirming the user is returned to the venue and past the gate. Whether the exact /Coaching/Summary/<guid>?campaign=… deep page + query survive sign-in for a returning, profile-complete user (no Your Details step) needs a pre-provisioned account (seed creds, skipping signup).

Net result & follow-ups