# Auth0 Usage Report — AllGifted Math API

**Investigated:** 2026-05-08 · **Scope:** read-only static analysis. No files modified.

---

## 1. Files present

| Path | Exists | Notes |
|---|---|---|
| `config/auth0.php` | **Yes** (558 B) | Reads `AUTH0_DOMAIN/CLIENT_ID/CLIENT_SECRET/REDIRECT_URI/AUDIENCE` from env. |
| `config/laravel-auth0.php` | **Yes** (3 073 B) | Hardcoded `pamelalim.auth0.com`, hardcoded `client_secret` `<redacted; rotated 2026-05-08; see Phase 0 rotation list>` (also leaked in `.env.production` history — already flagged in AUDIT.md). |
| `.auth0.api.json` | **Yes** (394 B) | Auth0 CLI artefact. |
| `.auth0.app.json` | **Yes** (5 264 B) | Auth0 CLI artefact, contains `http://auth0.com/oauth/grant-type/password-realm` config. |
| `auth0.exe` | **Yes** (49 952 768 B) | The Auth0 CLI Windows binary committed to the repo. |
| `app/Http/Middleware/Auth0JWTMiddleware.php` | **Yes** (949 B) | `use Auth0\Laravel\Facade\Auth0; use App\User;` — both refer to packages/classes that no longer exist (see §3, §4). Would fatal on instantiation. |
| `app/Http/Middleware/CheckJWT.php` | **Yes** (348 B) | **Not Auth0-specific.** It is a literal pass-through: ```public function handle($request, Closure $next) { return $next($request); }```. Just a no-op stub from a 2019 commit ("changes to production"). |

---

## 2. Middleware registration

**`php artisan route:list --json`** → no route's middleware chain contains `Auth0JWTMiddleware` or `CheckJWT`. Programmatic search across all 239 routes returns:

```
Routes with Auth0JWTMiddleware: 0
Routes with CheckJWT: 0
```

**`bootstrap/app.php`** (Laravel 11 middleware registration):

- Grep for `auth0|Auth0|JWT|jwt` (case-insensitive) → **no matches**.
- The `$middleware->alias([...])` block registers only `admin`, `auth`, `verified`, `cors.image`, `qa`, `can.manage.users`. No Auth0 alias. No `jwt` alias.

**`app/Http/Kernel.php`** — file does not exist. (Laravel 11 doesn't ship one by default; middleware lives in `bootstrap/app.php`.)

---

## 3. Code references

Repo-wide grep for `auth0` (case-insensitive), excluding `vendor/`, `node_modules/`, `storage/`, `public/`. Results categorised:

### 3a. Live code (PHP under `app/` and `config/`)

| File | Line(s) | Category | Live? |
|---|---|---|---|
| `app/Http/Middleware/Auth0JWTMiddleware.php` | 4 | use-statement: `use Auth0\Laravel\Facade\Auth0;` | **Dead** — `Auth0\Laravel` package is not installed (see §4). Loading this class would fatal. |
| `app/Http/Middleware/Auth0JWTMiddleware.php` | 5 | use-statement: `use App\User;` | **Dead** — model lives at `App\Models\User`; `App\User` does not exist. |
| `app/Http/Middleware/Auth0JWTMiddleware.php` | 7-32 | class definition + `Auth::login` flow | **Dead** — no route registers it (§2). Even if it were, it would fatal at autoload because of the two missing imports above. |
| `app/Repositories/UserRepository.php` | 8 | use-statement: `use App\User;` | **Dead** — same missing-class problem. |
| `app/Repositories/UserRepository.php` | 9 | use-statement: `use Auth0\Laravel\{UserRepositoryAbstract, UserRepositoryContract};` | **Dead** — package not installed. |
| `app/Repositories/UserRepository.php` | 15 | `extends UserRepositoryAbstract` | **Dead.** Class is final but never resolved by the container; not bound in any provider. |
| `app/Repositories/UserRepository.php` | 30, 35, 54, 58, 65, 76, 88, 89, 117, 125, 132 | reads `users.auth0` column, `Cache::get('auth0_user_…')`, comments | **Dead** in the live request lifecycle. |
| `config/auth0.php` | 5, 8, 11, 14, 17 | env-references: `env('AUTH0_DOMAIN')` etc. | **Dormant** config — the file is loaded by Laravel as `config('auth0.*')` but I find no caller of `config('auth0.…')` anywhere. |
| `config/laravel-auth0.php` | entire file | hardcoded credentials + comments | **Dead** — no caller of `config('laravel-auth0.…')`. |

### 3b. Database / migration

| File | Line(s) | Category |
|---|---|---|
| `database/migrations/2024_05_09_215412_update_users_table.php` | 12, 15, 22, 24 | Adds `users.auth0` nullable string column with a unique index `users_auth0_unique`. **Migration is still active**, so the DB column exists. No model code (`app/Models/User.php`) reads or writes it (see §5). |

### 3c. Documentation, dumps, and history (informational only)

| File | Why it appears |
|---|---|
| `api-backup-2025-09-30.sql` (root) and `resources/views/admin/questions/mathapi11v2/2025{0824,0930,1002}.sql` | DB dumps containing the `users.auth0` column. |
| `resources/views/admin/questions/mathapi11v2/.env.dev` (lines 25-27) | `AUTH0_DOMAIN=YOUR_AUTH0_DOMAIN` / `AUTH0_CLIENT_ID=YOUR_CLIENT_ID` / `AUTH0_CLIENT_SECRET=YOUR_CLIENT_SECRET` (placeholder values — duplicate-of-repo artefact). |
| `resources/views/admin/questions/mathapi11v2/.env.save.1` (lines 25-27) | Real `AUTH0_CLIENT_ID=<redacted; rotated 2026-05-08; see Phase 0 rotation list>`, real domain `pamelalim.auth0.com`, partial client secret. |
| `resources/views/admin/questions/mathapi11v2/.auth0.app.json` | Duplicate of root file. |
| `AUDIT.md` | Prior audit notes (mine). Not source. |

### 3d. `config/auth.php` audit

`config/auth.php` has no `auth0` guard, no `auth0` provider, and no reference to any Auth0 class. The defaults are `'guard' => 'web'` (session) and `'api' => ['driver' => 'sanctum']`. **Auth0 is not wired into Laravel's auth subsystem.**

### 3e. Live calls into Auth0 SDK or env

- No controller, service, job, command, or model contains `use Auth0\…` or invokes any Auth0 SDK method.
- No controller, service, job, command, or model reads any `env('AUTH0_…')` or `config('auth0.…')`. The only readers are `config/auth0.php` itself (which loads env at config-build time) and `config/laravel-auth0.php` (hardcoded literals, no env reads).

---

## 4. Composer

- `composer.json` — `grep -i auth0` → **no matches**. No Auth0 package declared.
- `composer.lock` — `grep -i auth0` → **no matches**. No Auth0 package installed.
- `vendor/auth0/` directory does not exist.

`auth0/auth0-php` and `auth0/login` are **absent**. `Auth0\Laravel\…` namespace cannot resolve at runtime.

---

## 5. Database

**Migrations:**
- Single hit: `database/migrations/2024_05_09_215412_update_users_table.php` adds `users.auth0` (nullable varchar) and `users_auth0_unique` index. `down()` drops them. The migration is still in the migration set, so live DBs (per the SQL dumps under `resources/views/admin/questions/…/202508*.sql`) carry an `auth0 varchar(255) DEFAULT NULL` column with a unique key.
- No `auth0_id`, `auth0_sub`, `provider_id`, or similar columns in any other migration.

**`app/Models/User.php`:**
- `grep -i auth0 app/Models/User.php` → **0 hits.**
- `$fillable` (`User.php:37-77`) does **not** list `auth0`.
- `$casts`, `$hidden`, `$dates` do not mention `auth0`.
- No method body reads or writes `$user->auth0`.

→ The DB column is orphaned: it exists on disk but is unreachable through Eloquent (and would silently drop any value passed via `User::create([..., 'auth0' => …])` because mass assignment is gated by `$fillable`).

---

## 6. Env

**`.env` (live, in repo root):**

```
$ grep '^AUTH0' .env
(no output)
```

→ **Zero `AUTH0_*` keys are set.** `config/auth0.php` reads `env('AUTH0_DOMAIN')` etc., all of which return `null` at runtime.

**`AUTH0_*` keys referenced in code/files (search results from `grep -r AUTH0_`):**

| Key | Read by | Reachable? |
|---|---|---|
| `AUTH0_DOMAIN` | `config/auth0.php:5` | Config compiled, never consumed. |
| `AUTH0_CLIENT_ID` | `config/auth0.php:8` | Config compiled, never consumed. |
| `AUTH0_CLIENT_SECRET` | `config/auth0.php:11` | Config compiled, never consumed. |
| `AUTH0_REDIRECT_URI` | `config/auth0.php:14` | Config compiled, never consumed. |
| `AUTH0_AUDIENCE` | `config/auth0.php:17` | Config compiled, never consumed. |

The other `AUTH0_*` strings only appear in the **stale duplicate** under `resources/views/admin/questions/mathapi11v2/.env.dev` and `.env.save.1` — not in the live `.env` and not read by Laravel.

`grep -r 'config(.auth0' app/ routes/ resources/views/ database/` → **no callers**.

---

## 7. Git history

### Last modification per Auth0 artefact

| Path | Last commit | Date |
|---|---|---|
| `config/auth0.php` | `3d65661` "WIP: Commit before pulling from mathflutter" | **2025-07-21** |
| `config/laravel-auth0.php` | `e0f7d35` "fix auth0 alg" | **2024-04-15** |
| `.auth0.api.json` | `4ac6f55` "Implemented OTP" | **2025-04-16** |
| `.auth0.app.json` | `4ac6f55` "Implemented OTP" | **2025-04-16** |
| `auth0.exe` | `b5fadec` "fix auth0" | **2024-05-10** |
| `app/Http/Middleware/Auth0JWTMiddleware.php` | `b5fadec` "fix auth0" | **2024-05-10** |
| `app/Http/Middleware/CheckJWT.php` | `5b88fdd` "changes to production" | **2019-01-29** |
| `app/Repositories/UserRepository.php` | `86d8283` "Fix auth0 user" | **2024-05-09** |

### Migration narrative (commit-message search)

`git log --all -i --grep='sanctum'` → **no matches**. No commit message references Sanctum at all.

`git log --all -i --grep='OTP' --pretty='%ai %h %s'`:
```
2025-10-11  bb23521  capitals in OTP
2025-10-11  25031af  capitals in OTP
2025-08-31  0b4d71f  OTP for partners done
2025-04-16  4ac6f55  Implemented OTP
```

→ The transition was **April 2025**: commit `4ac6f55` "Implemented OTP" (also touches `.auth0.api.json` / `.auth0.app.json`) is the cut-over to OTP-based auth. There is no explicit "remove Auth0" commit; the Auth0 wiring was simply abandoned, leaving the dormant files behind. The Auth0 CLI binary, config, and middleware have not been touched in **~12 months**, and the CheckJWT no-op middleware has been untouched for **7 years**.

---

## Verdict per artefact

| Artefact | Classification |
|---|---|
| `config/auth0.php` | **DORMANT** — loaded by Laravel into `config()`, but no code reads `config('auth0.…')`. Safe to remove after a grep confirms (already done). |
| `config/laravel-auth0.php` | **DEAD** — no caller of `config('laravel-auth0.…')`; package that would consume it is not installed. Removable. |
| `.auth0.api.json` | **DEAD** — Auth0 CLI workspace artefact; no app code reads it. Removable (and currently leaks tenant info). |
| `.auth0.app.json` | **DEAD** — same. Removable. |
| `auth0.exe` | **DEAD** — 50 MB Auth0 CLI binary checked into the repo; not invoked by any script (no `auth0.exe` reference in `composer.json`, `package.json`, `deploy.sh`, or any PHP). Removable. |
| `app/Http/Middleware/Auth0JWTMiddleware.php` | **DEAD** — not aliased in `bootstrap/app.php`, not on any route, and would fatal on autoload because `Auth0\Laravel\Facade\Auth0` and `App\User` no longer exist. Removable. |
| `app/Http/Middleware/CheckJWT.php` | **DEAD** — pass-through stub since 2019; **not Auth0-specific** but also not Auth0 evidence. Not aliased and not on any route. Removable. |
| `app/Repositories/UserRepository.php` | **DEAD** — extends `Auth0\Laravel\UserRepositoryAbstract` (missing class), uses `App\User` (missing class), is not bound or instantiated anywhere. Removable. |
| `users.auth0` DB column + `users_auth0_unique` migration | **DEAD** — column exists on production DBs (per SQL dumps) but no model property and no reader/writer. Safe to mark for cleanup migration; beware orphaned values may exist in legacy rows. |
| `AUTH0_*` env keys | **DEAD** — none set in live `.env`; config reads return `null`; config consumers do not exist. Removable. |

---

## Overall verdict

**Auth0 is DEAD in this codebase** — no Composer package installed (`Auth0\Laravel` namespace cannot resolve), no route uses `Auth0JWTMiddleware`, no `AUTH0_*` env vars are set in `.env`, no `config('auth0.*')` is read, and authentication runs entirely on `laravel/sanctum` + custom OTP since commit `4ac6f55` (2025-04-16).