URGENT: mendys-platform Authentik provider rejects authorize with invalid_request (prod portal down)

[izzywdev]

@claude Production incident on MendysRobotics (Jira MR-22, Critical): with login enforcement on, live.mendysrobotics.com is stuck in a login redirect loop. Backend logs show Authentik rejecting the AUTHORIZE request for the mendys-platform client:

GET /auth/oidc/callback?error=invalid_request&error_description=The%20request%20is%20otherwise%20malformed&state=...

Key facts:

• The error comes back to our REGISTERED redirect URI, so client_id (mendys-platform-oidc-client) and redirect_uri are recognized by Authentik — the request dies during authorize validation, BEFORE any token exchange.
• Our authorize request params: response_type=code, scope=openid email profile, state, nonce, code_challenge + code_challenge_method=S256 — identical shape to the working mendys-datasets flow.

Request: diff the mendys-platform OAuth2 provider (blueprint provider-oidc-mendys-platform.yaml) against the WORKING mendys-datasets provider and fix the delta. Leading suspects, in order:

1. Missing/unbound authorization_flow on the provider (a provider without one rejects authorize as malformed).
2. Missing scope mappings (openid/email/profile property mappings not attached).
3. PKCE/invalidation_flow misconfiguration vs the datasets provider.

Please also confirm the provider's application slug is mendys-platform and both redirect URIs are present in STRICT mode:

• https://live.mendysrobotics.com/api/auth/oidc/callback
• https://marketplace.mendysrobotics.com/api/auth/oidc/callback

Mendys side: portal access is being restored via the documented requireLogin rollback while this is fixed; an SPA loop-breaker fix is also landing. We'll re-test the full login (MR-18 checklist) as soon as you confirm the provider is corrected.

---

Generated by Claude Code

[izzywdev]

⚠️ Claude responder did not run to completion

The responder errored before finishing your request, so no changes were made and no branch was created.

• Reason: Anthropic API rejected preflight (HTTP 400): Your credit balance is too low to access the Anthropic API. Please go to Plans & Billing to upgrade or purchase credits.
• Run log: https://github.com/izzywdev/FuzeInfra/actions/runs/30761888374

This notice is automated and will not retry on its own — the responder stops after one failure and waits. If this looks like an API-side problem (key revoked / out of credits / model or 1M-context beta not entitled / Anthropic outage), an operator should check the ANTHROPIC_API_KEY secret and fund/repair the Anthropic account first, then re-trigger by posting a new comment mentioning the responder.

[izzywdev]

Delegated to FuzeFront#514 for resolution. The fix (force blueprint re-apply of the mendys-platform OIDC provider to update the live Authentik object with authorization_flow + grant_types) lives in the FuzeFront blueprint files. This issue will remain open until that PR merges and the authorize flow is verified clean.