AUTH4D-209 Flows signing secret in the console

AUTH4D-209 lets owners and admins create and rotate the project’s call_backend signing secret (AUTH4D-160) from the console. It adds no routes, contracts, migrations or audit events: the console calls the existing routes through its BFF, which already forwarded /api/management/tenants/{tenantId}/flow-signing-secret.

Every create or rotation still writes management.flow.signing_secret_rotated (target type flow_signing_secret), and refusals are recorded with outcome denied.

Console

Settings → Open the flows storyboard → Flows signing secret shows whether the project has a secret and when it was created. Owners and admins see Create secret, or Rotate secret once one exists. Both ask for confirmation; rotating warns that the old secret stops working at once. The new secret is then shown once in a dialog with a copy button, and closes only through I’ve saved the secret. It is kept in page memory for that dialog only: never in a URL, browser storage or history state, and it is not shown again after the dialog closes. Viewers see the status without the actions. Errors use console wording (for example not_ready: “Secrets can’t be stored in this environment yet.”); the API’s descriptions are never shown.

The Backend URL hint of a Call your backend step points to this section.

Tests

• tests/e2e/auth4d-209.flows-signing-secret.spec.ts (auth4d-209.playwright.config.ts, port 5379): create with the one-time secret, rotate, the secret gone from the page after each dialog, {} request bodies, cancel sends nothing, viewer access, console wording for a 503 not_ready, and axe checks at 1280px and 320px.
• The API behaviour, audit events and role checks stay covered by tests/integration/auth4d-160.flow-steps.test.ts.