Remove unused default flow configurations

docs/content/deployment/configuration.mdx

@@ -953,10 +953,6 @@ Configure flow defaults in either of these ways:
 Set `defaultHandle` only for flow types that have a corresponding flow in your deployment. The handle is validated when the configuration is written. An unknown handle or a handle belonging to a different flow type is rejected with `SCF-1003`. For optional types (registration, recovery, user-onboarding, sign-out), omit `defaultHandle` to leave the server-level default empty.
 :::
 
-:::note
-`deployment.yaml` previously held `flow.default_auth_flow_handle`, `flow.default_signout_flow_handle`, and `flow.user_onboarding_flow_handle`. These keys are no longer read. Move any values you relied on into the `flow` server-config section using one of the methods above.
-:::
-
 ## Passkey Configuration
 
 WebAuthn/Passkey settings (typically defined in `deployment.yaml`).

install/helm/README.md

@@ -502,7 +502,6 @@ Password fields are available in `configuration.database.config.postgres`, `conf
 | `configuration.oauth.refreshToken.renewOnGrant`   | Renew refresh token on grant                                                                                                                            | `false`                      |
 | `configuration.oauth.refreshToken.revokePreviousOnRenew` | Revoke the consumed refresh token on rotation (single-use); effective only when `renewOnGrant` is `true`                                          | `true`                       |
 | `configuration.oauth.refreshToken.validityPeriod` | Refresh token validity period in seconds                                                                                                                | `86400`                      |
-| `configuration.flow.defaultAuthFlowHandle`        | Default authentication flow handle                                                                                                                      | `default-flow`         |
 | `configuration.flow.maxVersionHistory`            | Maximum flow version history to retain                                                                                                                  | `3`                          |
 | `configuration.flow.autoInferRegistration`        | Enable auto-infer registration flow                                                                                                                     | `true`                       |
 | `configuration.passkey.allowedOrigins`            | Passkey allowed origins                                                                                                                                 | `[]`                         |

install/helm/conf/deployment.yaml

@@ -261,8 +261,6 @@ oauth:
   {{- end }}
 
 flow:
-  default_auth_flow_handle: {{ .Values.configuration.flow.defaultAuthFlowHandle | quote }}
-  default_signout_flow_handle: {{ .Values.configuration.flow.defaultSignOutFlowHandle | quote }}
   max_version_history: {{ .Values.configuration.flow.maxVersionHistory }}
   auto_infer_registration: {{ .Values.configuration.flow.autoInferRegistration }}
 {{- if .Values.configuration.flow.executors }}

install/helm/values.yaml

@@ -438,8 +438,6 @@ configuration:
 
   # Flow configuration
   flow:
-    defaultAuthFlowHandle: "default-flow"
-    defaultSignOutFlowHandle: "default-flow"
     maxVersionHistory: 3
     autoInferRegistration: true
     # Optional whitelist of built-in executor names to register at startup.

install/openchoreo/thunderid-oc-resourcetype/README.md

@@ -349,7 +349,6 @@ A second `HTTPRoute` is rendered for that hostname and the Console's
 | `runtime.tls.verifyBackend` | Verify the backend certificate at the gateway against the `ca.crt` property at `runtime.certs.storeKey` (publish `ca.crt` there when enabling this); off skips verification (encrypted, unverified) | `false` |
 | `runtime.certs.storeKey` | Optional separate store entry for the certificate/key files. Empty (default): read them from `secretStore.key` alongside the environment values. Set: materialize them from this entry into a dedicated `-certs` Secret. Either way the JWT signing pairs are always mounted over `config/certs/`, plus the serving pair when `tls.enabled` | `""` (use `secretStore.key`) |
 | `runtime.certs.extraFiles` | Additional properties to project over `config/certs/` beyond the always-mounted signing (and, with TLS, serving) pairs | `[]` |
-| `runtime.defaultAuthFlowHandle` | Flow handle used when an application does not pin its own `authFlowId`; empty inherits the server default | `""` |
 | `runtime.dbType` | Database engine — `sqlite` (bundled files, ephemeral pod-local storage, development only) or `postgres` (externally hosted, production) | `sqlite` |
 | `runtime.imagePullPolicy` | `Always` / `IfNotPresent` / `Never` | `Always` |
 | `runtime.port` | Port the ThunderID server listens on | `8090` |

install/openchoreo/thunderid-oc-resourcetype/samples/resource.yaml

@@ -121,8 +121,6 @@ spec:
     #   # the DB_* properties at secretStore.key, for production.
     #   dbType: sqlite                     # sqlite | postgres
     #   port: 8090                         # server port (container, Service, route, probe)
-    #   defaultAuthFlowHandle: ""          # flow used when an application pins no authFlowId
-    #   defaultSignOutFlowHandle: ""       # flow used when an application pins no signOutFlowId
     #   declarativeResourcesEnabled: true  # false: services default to database-backed stores
     #   gate:
     #     clientBase: "/gate"

install/openchoreo/thunderid-oc-resourcetype/templates/thunderid-resourcetype.yaml

@@ -183,16 +183,6 @@ spec:
                   items:
                     type: string
                     pattern: "^[A-Za-z0-9._-]+$"
-            # Handle of the flow used when an application does not pin its
-            # own authFlowId. Empty inherits the server default.
-            defaultAuthFlowHandle:
-              type: string
-              default: ""
-            # Handle of the flow used when an application does not pin its
-            # own signOutFlowId. Empty inherits the server default.
-            defaultSignOutFlowHandle:
-              type: string
-              default: ""
             # Global declarative mode: services without an explicit
             # stores.* override behave as "declarative" when true. Set to
             # false to opt services back to database-backed stores by
@@ -470,8 +460,6 @@ spec:
                 validity_period: ${parameters.runtime.oauth.refreshTokenValidityPeriod}
 
             flow:
-              default_auth_flow_handle: "${parameters.runtime.defaultAuthFlowHandle}"
-              default_signout_flow_handle: "${parameters.runtime.defaultSignOutFlowHandle}"
               max_version_history: 3
               auto_infer_registration: true
               store: "${parameters.runtime.stores.flow}"
@@ -590,8 +578,6 @@ spec:
                 validity_period: ${parameters.runtime.oauth.refreshTokenValidityPeriod}
 
             flow:
-              default_auth_flow_handle: "${parameters.runtime.defaultAuthFlowHandle}"
-              default_signout_flow_handle: "${parameters.runtime.defaultSignOutFlowHandle}"
               max_version_history: 3
               auto_infer_registration: true
               store: "${parameters.runtime.stores.flow}"