tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(tasks): enrich Prompt 4.1 for Jules with comprehensive Tier 1 bypass and allowlist architecture

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-24 13:39:56 -07:00
parent 7420401147
commit 2e30c5ad3e
1 changed files with 43 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
tasks/JULES_PROMPTS.md
View File

@ -9,14 +9,14 @@ and
## Progress & Execution Roadmap
| Prompt ID | Task Scope | Status | Target File |
| :------------- | :----------------------------------------------------- | :-------------- | :-------------------------------------------- |
| **Prompt 1.1** | Ingress Grant Vector Injection (`/api/forward-auth`) | ✅ **COMPLETE** | `server/main.ts`, `server/auth-session.ts` |
| **Prompt 1.2** | SDK Real-Time Invalidation Event Bus (`@auth-yes/sdk`) | ✅ **COMPLETE** | `sdk/mod.ts` |
| **Prompt 3.2** | Native SIMD Argon2id Derivation in `spire_ffi` | ✅ **COMPLETE** | `spire_ffi/src/lib.rs`, `server/spire_ffi.ts` |
| **Prompt 2.2** | Ghost Cockpit Protocol & WebSocket Freeze/Re-Auth | ✅ **COMPLETE** | `docs/GHOST_COCKPIT_SPEC.md`, `sdk/hono.ts` |
| **Prompt 2.1** | RFC 9421 HTTP Signatures & `Signature-Key` (`hwk`) | ✅ **COMPLETE** | `server/http_signatures.ts`, `server/main.ts` |
| **Prompt 3.1** | WebAuthn PRF Extension & Progressive Fallback | ✅ **COMPLETE** | `server/main.ts`, `ui/public/auth-client.js` |
| Prompt ID | Task Scope | Status | Target File |
| :------------- | :----------------------------------------------------- | :------------------------------ | :-------------------------------------------- |
| **Prompt 1.1** | Ingress Grant Vector Injection (`/api/forward-auth`) | ✅ **COMPLETE** | `server/main.ts`, `server/auth-session.ts` |
| **Prompt 1.2** | SDK Real-Time Invalidation Event Bus (`@auth-yes/sdk`) | ✅ **COMPLETE** | `sdk/mod.ts` |
| **Prompt 3.2** | Native SIMD Argon2id Derivation in `spire_ffi` | ✅ **COMPLETE** | `spire_ffi/src/lib.rs`, `server/spire_ffi.ts` |
| **Prompt 2.2** | Ghost Cockpit Protocol & WebSocket Freeze/Re-Auth | ✅ **COMPLETE** | `docs/GHOST_COCKPIT_SPEC.md`, `sdk/hono.ts` |
| **Prompt 2.1** | RFC 9421 HTTP Signatures & `Signature-Key` (`hwk`) | ✅ **COMPLETE** | `server/http_signatures.ts`, `server/main.ts` |
| **Prompt 3.1** | WebAuthn PRF Extension & Progressive Fallback | ✅ **COMPLETE** | `server/main.ts`, `ui/public/auth-client.js` |
| **Prompt 3.3** | 2-of-3 SSS Recovery Matrix (Wasm/Rust) | ✅ **COMPLETE** | `ui/components/RecoveryPage.tsx`, `wasm/` |
| **Prompt 3.4** | RFC 6962 Merkle Tree Audit Ledger & STH | ✅ **COMPLETE** | `server/audit_merkle.ts`, `server/audit.ts` |
| **Prompt 4.1** | Traefik Tier 1 Global Ingress Hardening & Discovery | ⏳ **PENDING (Next Milestone)** | `infra/`, Host Traefik Config |
@ -174,22 +174,46 @@ _Completed task:
## Phase 4 Prompts
### Prompt 4.1: Traefik Tier 1 Global Ingress Hardening & Infrastructure Discovery
### Prompt 4.1: Traefik Tier 1 Universal Global Ingress Control & Multi-Tier Bypass/Allowlist Matrix
```text
**Role:** Act as a System Analyst and Solutions Architect. Do not execute code or modify the codebase during this session. Your sole deliverable is to generate a task file in tasks/new/.
**The Objective:** Perform infrastructure discovery and architectural specification for Tier 1 Global Edge Ingress Protection on the Traefik proxy, ensuring all untagged/pre-release containers across *.atyg.org default to ForwardAuth interception with proper public-bypass exemptions.
**The Objective:** Architect and formalize the Tier 1 Universal Global Edge Ingress Protection protocol for the central Traefik proxy. This system must enforce universal zero-trust ForwardAuth default-deny across all *.atyg.org domains while providing a comprehensive, user-friendly, and bulletproof multi-tier allowlist/bypass matrix for public applications, standard sub-paths, webhooks, and guest sandboxes.
**Scope & Exploration Targets:**
* Traefik host configuration discovery (dynamic/static file location on Synology host, entrypoint definition, middleware chaining).
* Configuring `authyes-forwardauth` on `entryPoints.websecure.http.middlewares` as the default global fallback.
* Bypass rules & path exemptions for public static assets (`/public/*`, `/.well-known/webauthn`, `/health`).
* End-to-end verification of zero-touch default-deny for untagged / unauthenticated containers across the network.
**Core Scope & Architectural Requirements to Explore:**
1. **Universal Edge Perimeter Default-Deny:**
* Configure Traefik's `entryPoints.websecure.http.middlewares` to apply ForwardAuth (`auth-forward@docker` / `authyes-forwardauth`) globally.
* Any new container or service spun up on the network is secure by default on first boot without requiring manual per-service Docker label configuration.
2. **Self-Exemption & Infinite Loop Prevention:**
* `auth-api` (`auth.atyg.org`) must be explicitly exempt from the global entrypoint middleware chain to eliminate recursive self-interception deadlocks.
* Document the exact Traefik static/dynamic provider configuration or router priority overrides to guarantee clean self-exemption.
3. **Multi-Tier Bypass & Allowlist Matrix:**
* **A. Host-Level Application Bypass (Opt-Out Labels):**
- Allow public apps (e.g. `public.atyg.org`, landing pages, open trial sandboxes) to opt out of ForwardAuth via explicit Docker labels (e.g., overriding router middlewares to empty string or attaching a bypass middleware).
* **B. Universal Path-Level Exemptions (Prefix & Regex Rules):**
- Common public paths must always bypass authentication across ALL applications without per-app custom rules:
- `/.well-known/*` (WebAuthn, ACME/Let's Encrypt challenge, RFC 7638 JWK thumbprints, OIDC metadata).
- `/health`, `/healthz`, `/livez`, `/readyz` (Traefik, Portainer, and orchestrator liveness probes).
- `/api/public/*`, `/public/*` (Public assets, favicons, open fonts).
- `/webhooks/*` (GitHub, Gitea, Stripe incoming webhooks authenticated via HMAC signature rather than session cookies).
- `raw/branch/main/sdk/*` (Unauthenticated SDK consumption by external agents and microservices).
* **C. Database-Driven Dynamic Bypass Matrix (Management Console Controlled):**
- In Auth-Yes database schema (`apps` table), support dynamic `is_public` booleans and `bypass_paths: text[]` array so administrators can add or remove public paths via the Auth-Yes UI/REST API without restarting Traefik or editing Docker compose labels.
* **D. Network / CIDR Allowlists (Trusted Private Mesh):**
- Support CIDR-based bypasses (e.g. local Docker networks, WireGuard/Tailscale VPN subnets, or specific management IPs).
* **E. Ephemeral Guest Sandboxes (Use Case 11 Alignment):**
- Support open trial / guest exploration with temporary tokens and in-flight passkey promotion.
4. **User-Friendly Error Handling & UX (No Cryptic Errors):**
* **Unregistered App Handling:** If an unregistered domain hits Traefik ForwardAuth, render a polished Hono SSR "Application Unregistered" page with guidance rather than a raw plaintext 403 error.
* **Dual-Response Protocol Compliance:** Ensure all interactive browser flows receive HTTP 302 Redirect with full deep-link preservation (`?redirect=...`), while API/cURL calls receive clean HTTP 401 Unauthorized without HTML redirect loops.
**Your Task:**
1. Research the Traefik infrastructure conventions in `COMPOSE_CONVENTIONS.md`, `ONBOARDING.md`, and `server/main.ts`.
2. Map out the `Target Files`, host configuration requirements, prerequisites, and potential architectural risks (e.g. infinite redirect loops on auth-api itself).
3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions and structure defined in `tasks/GUIDELINES.md`.
1. Research the Traefik infrastructure conventions in `COMPOSE_CONVENTIONS.md`, `ONBOARDING.md`, `docs/FORWARDAUTH_REDIRECT_SPEC.md`, and `server/main.ts`.
2. Map out the `Target Files`, host configuration requirements, database migrations, and potential architectural risks.
3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions, header metadata, and mandatory structure defined in `tasks/GUIDELINES.md`.
```