---
category: dev
tags: [bugfix, auth, deployment, beta]
last_updated: 2026-03-16
confidence: high
---

# 2026-03-16: Beta User TLS Fix

## Symptom

Beta users (gruen, igor) reported TLS certificate errors when visiting their `{slug}.robot.wtf` wikis. Caddy's on-demand TLS couldn't provision certs because `/api/internal/check-slug` returned 404 for their slugs.

## Root cause

The signup flow (`POST /auth/signup`) created user records but redirected to `https://robot.wtf/` — the static marketing landing page. The landing page had no link to the dashboard (`/app/`) or wiki creation form (`/app/create`). Users had no way to discover wiki creation. Without a wiki record in the `wikis` table, `check-slug` returns 404, Caddy refuses TLS, browser shows cert error.

The wiki creation machinery at `/app/create` was fully implemented and tested. The gap was purely in the redirect wiring.

## Fixes deployed

### 1. Post-signup/login redirect (`e6c5bba`)
- `auth_server.py`: Both OAuth callback and signup now redirect to `/app/` instead of `/`
- `api_server.py`: Landing page (`/`) checks JWT cookie and redirects authenticated users to `/app/`
- Tests added for redirect targets and `return_to` precedence (MCP consent flow)

### 2. Private wiki auth redirect (`13f4762`)
- `resolver.py`: Unauthenticated browser visitors to private wiki subdomains get a 302 to `https://robot.wtf/auth/login` instead of a JSON 403
- API/MCP clients still get JSON 403 (checks `Accept: text/html`)
- Redirect only on 403 (access denied), not 401 (bad credentials)

### 3. Manual wiki creation for stranded users
- Created wiki records, ACLs, git repos, and MCP tokens for gruen and igor directly in the DB
- Users can regenerate tokens from the dashboard (`/app/wiki/{slug}/mcp/regenerate`)

## Process lessons

- Implementation Workflow updated with Step 0: read memories and create task list before dispatching any agents
- Worktree agents must be launched from the git repo directory, not the parent (`/Users/sderle/code/otterwiki/` is not a git repo)
- Both of these were already in memory but were not consulted at session start