From 2e30c5ad3ea8d01ca9bb2568759a7607baf47272 Mon Sep 17 00:00:00 2001 From: Tyler Gillispie Date: Mon, 24 Aug 2026 13:39:56 -0700 Subject: [PATCH] docs(tasks): enrich Prompt 4.1 for Jules with comprehensive Tier 1 bypass and allowlist architecture --- tasks/JULES_PROMPTS.md | 62 +++++++++++++++++++++++++++++------------- 1 file changed, 43 insertions(+), 19 deletions(-) diff --git a/tasks/JULES_PROMPTS.md b/tasks/JULES_PROMPTS.md index 37a70b3..28510e6 100644 --- a/tasks/JULES_PROMPTS.md +++ b/tasks/JULES_PROMPTS.md @@ -9,14 +9,14 @@ and ## Progress & Execution Roadmap -| Prompt ID | Task Scope | Status | Target File | -| :------------- | :----------------------------------------------------- | :-------------- | :-------------------------------------------- | -| **Prompt 1.1** | Ingress Grant Vector Injection (`/api/forward-auth`) | ✅ **COMPLETE** | `server/main.ts`, `server/auth-session.ts` | -| **Prompt 1.2** | SDK Real-Time Invalidation Event Bus (`@auth-yes/sdk`) | ✅ **COMPLETE** | `sdk/mod.ts` | -| **Prompt 3.2** | Native SIMD Argon2id Derivation in `spire_ffi` | ✅ **COMPLETE** | `spire_ffi/src/lib.rs`, `server/spire_ffi.ts` | -| **Prompt 2.2** | Ghost Cockpit Protocol & WebSocket Freeze/Re-Auth | ✅ **COMPLETE** | `docs/GHOST_COCKPIT_SPEC.md`, `sdk/hono.ts` | -| **Prompt 2.1** | RFC 9421 HTTP Signatures & `Signature-Key` (`hwk`) | ✅ **COMPLETE** | `server/http_signatures.ts`, `server/main.ts` | -| **Prompt 3.1** | WebAuthn PRF Extension & Progressive Fallback | ✅ **COMPLETE** | `server/main.ts`, `ui/public/auth-client.js` | +| Prompt ID | Task Scope | Status | Target File | +| :------------- | :----------------------------------------------------- | :------------------------------ | :-------------------------------------------- | +| **Prompt 1.1** | Ingress Grant Vector Injection (`/api/forward-auth`) | ✅ **COMPLETE** | `server/main.ts`, `server/auth-session.ts` | +| **Prompt 1.2** | SDK Real-Time Invalidation Event Bus (`@auth-yes/sdk`) | ✅ **COMPLETE** | `sdk/mod.ts` | +| **Prompt 3.2** | Native SIMD Argon2id Derivation in `spire_ffi` | ✅ **COMPLETE** | `spire_ffi/src/lib.rs`, `server/spire_ffi.ts` | +| **Prompt 2.2** | Ghost Cockpit Protocol & WebSocket Freeze/Re-Auth | ✅ **COMPLETE** | `docs/GHOST_COCKPIT_SPEC.md`, `sdk/hono.ts` | +| **Prompt 2.1** | RFC 9421 HTTP Signatures & `Signature-Key` (`hwk`) | ✅ **COMPLETE** | `server/http_signatures.ts`, `server/main.ts` | +| **Prompt 3.1** | WebAuthn PRF Extension & Progressive Fallback | ✅ **COMPLETE** | `server/main.ts`, `ui/public/auth-client.js` | | **Prompt 3.3** | 2-of-3 SSS Recovery Matrix (Wasm/Rust) | ✅ **COMPLETE** | `ui/components/RecoveryPage.tsx`, `wasm/` | | **Prompt 3.4** | RFC 6962 Merkle Tree Audit Ledger & STH | ✅ **COMPLETE** | `server/audit_merkle.ts`, `server/audit.ts` | | **Prompt 4.1** | Traefik Tier 1 Global Ingress Hardening & Discovery | ⏳ **PENDING (Next Milestone)** | `infra/`, Host Traefik Config | @@ -174,22 +174,46 @@ _Completed task: ## Phase 4 Prompts -### Prompt 4.1: Traefik Tier 1 Global Ingress Hardening & Infrastructure Discovery +### Prompt 4.1: Traefik Tier 1 Universal Global Ingress Control & Multi-Tier Bypass/Allowlist Matrix ```text **Role:** Act as a System Analyst and Solutions Architect. Do not execute code or modify the codebase during this session. Your sole deliverable is to generate a task file in tasks/new/. -**The Objective:** Perform infrastructure discovery and architectural specification for Tier 1 Global Edge Ingress Protection on the Traefik proxy, ensuring all untagged/pre-release containers across *.atyg.org default to ForwardAuth interception with proper public-bypass exemptions. +**The Objective:** Architect and formalize the Tier 1 Universal Global Edge Ingress Protection protocol for the central Traefik proxy. This system must enforce universal zero-trust ForwardAuth default-deny across all *.atyg.org domains while providing a comprehensive, user-friendly, and bulletproof multi-tier allowlist/bypass matrix for public applications, standard sub-paths, webhooks, and guest sandboxes. -**Scope & Exploration Targets:** -* Traefik host configuration discovery (dynamic/static file location on Synology host, entrypoint definition, middleware chaining). -* Configuring `authyes-forwardauth` on `entryPoints.websecure.http.middlewares` as the default global fallback. -* Bypass rules & path exemptions for public static assets (`/public/*`, `/.well-known/webauthn`, `/health`). -* End-to-end verification of zero-touch default-deny for untagged / unauthenticated containers across the network. +**Core Scope & Architectural Requirements to Explore:** + +1. **Universal Edge Perimeter Default-Deny:** + * Configure Traefik's `entryPoints.websecure.http.middlewares` to apply ForwardAuth (`auth-forward@docker` / `authyes-forwardauth`) globally. + * Any new container or service spun up on the network is secure by default on first boot without requiring manual per-service Docker label configuration. + +2. **Self-Exemption & Infinite Loop Prevention:** + * `auth-api` (`auth.atyg.org`) must be explicitly exempt from the global entrypoint middleware chain to eliminate recursive self-interception deadlocks. + * Document the exact Traefik static/dynamic provider configuration or router priority overrides to guarantee clean self-exemption. + +3. **Multi-Tier Bypass & Allowlist Matrix:** + * **A. Host-Level Application Bypass (Opt-Out Labels):** + - Allow public apps (e.g. `public.atyg.org`, landing pages, open trial sandboxes) to opt out of ForwardAuth via explicit Docker labels (e.g., overriding router middlewares to empty string or attaching a bypass middleware). + * **B. Universal Path-Level Exemptions (Prefix & Regex Rules):** + - Common public paths must always bypass authentication across ALL applications without per-app custom rules: + - `/.well-known/*` (WebAuthn, ACME/Let's Encrypt challenge, RFC 7638 JWK thumbprints, OIDC metadata). + - `/health`, `/healthz`, `/livez`, `/readyz` (Traefik, Portainer, and orchestrator liveness probes). + - `/api/public/*`, `/public/*` (Public assets, favicons, open fonts). + - `/webhooks/*` (GitHub, Gitea, Stripe incoming webhooks authenticated via HMAC signature rather than session cookies). + - `raw/branch/main/sdk/*` (Unauthenticated SDK consumption by external agents and microservices). + * **C. Database-Driven Dynamic Bypass Matrix (Management Console Controlled):** + - In Auth-Yes database schema (`apps` table), support dynamic `is_public` booleans and `bypass_paths: text[]` array so administrators can add or remove public paths via the Auth-Yes UI/REST API without restarting Traefik or editing Docker compose labels. + * **D. Network / CIDR Allowlists (Trusted Private Mesh):** + - Support CIDR-based bypasses (e.g. local Docker networks, WireGuard/Tailscale VPN subnets, or specific management IPs). + * **E. Ephemeral Guest Sandboxes (Use Case 11 Alignment):** + - Support open trial / guest exploration with temporary tokens and in-flight passkey promotion. + +4. **User-Friendly Error Handling & UX (No Cryptic Errors):** + * **Unregistered App Handling:** If an unregistered domain hits Traefik ForwardAuth, render a polished Hono SSR "Application Unregistered" page with guidance rather than a raw plaintext 403 error. + * **Dual-Response Protocol Compliance:** Ensure all interactive browser flows receive HTTP 302 Redirect with full deep-link preservation (`?redirect=...`), while API/cURL calls receive clean HTTP 401 Unauthorized without HTML redirect loops. **Your Task:** -1. Research the Traefik infrastructure conventions in `COMPOSE_CONVENTIONS.md`, `ONBOARDING.md`, and `server/main.ts`. -2. Map out the `Target Files`, host configuration requirements, prerequisites, and potential architectural risks (e.g. infinite redirect loops on auth-api itself). -3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions and structure defined in `tasks/GUIDELINES.md`. +1. Research the Traefik infrastructure conventions in `COMPOSE_CONVENTIONS.md`, `ONBOARDING.md`, `docs/FORWARDAUTH_REDIRECT_SPEC.md`, and `server/main.ts`. +2. Map out the `Target Files`, host configuration requirements, database migrations, and potential architectural risks. +3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions, header metadata, and mandatory structure defined in `tasks/GUIDELINES.md`. ``` -