From 4fce954c86de54a5dbf2b0a8f001c0728d9a3848 Mon Sep 17 00:00:00 2001 From: Tyler Gillispie Date: Mon, 24 Aug 2026 13:56:12 -0700 Subject: [PATCH] docs(tasks): add Prompt 4.2 for Jules with SSO launchpad, logout return-path, and additive security audit --- tasks/JULES_PROMPTS.md | 44 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/tasks/JULES_PROMPTS.md b/tasks/JULES_PROMPTS.md index 28510e6..d1922ef 100644 --- a/tasks/JULES_PROMPTS.md +++ b/tasks/JULES_PROMPTS.md @@ -19,7 +19,8 @@ and | **Prompt 3.1** | WebAuthn PRF Extension & Progressive Fallback | ✅ **COMPLETE** | `server/main.ts`, `ui/public/auth-client.js` | | **Prompt 3.3** | 2-of-3 SSS Recovery Matrix (Wasm/Rust) | ✅ **COMPLETE** | `ui/components/RecoveryPage.tsx`, `wasm/` | | **Prompt 3.4** | RFC 6962 Merkle Tree Audit Ledger & STH | ✅ **COMPLETE** | `server/audit_merkle.ts`, `server/audit.ts` | -| **Prompt 4.1** | Traefik Tier 1 Global Ingress Hardening & Discovery | ⏳ **PENDING (Next Milestone)** | `infra/`, Host Traefik Config | +| **Prompt 4.1** | Traefik Tier 1 Universal Global Ingress Control | ⏳ **IN PLANNING (Jules #6742583984777370201)** | `infra/`, Host Traefik Config | +| **Prompt 4.2** | SSO Launchpad, Logout Return-Path & Hybrid Ingress | ⏳ **IN PLANNING (Next Milestone)** | `ui/`, `server/`, `docs/` | --- @@ -217,3 +218,44 @@ _Completed task: 2. Map out the `Target Files`, host configuration requirements, database migrations, and potential architectural risks. 3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions, header metadata, and mandatory structure defined in `tasks/GUIDELINES.md`. ``` + +--- + +### Prompt 4.2: Central SSO Application Launchpad, Logout Return-Path Preservation & Hybrid Ingress Gateway Protocol + +```text +**Role:** Act as a System Analyst and Solutions Architect. Do not execute code or modify the codebase during this session. Your sole deliverable is to generate a task file in tasks/new/. + +**The Objective:** Architect and formalize the specification and implementation plan for: +1. Universal Logout Return-Path Preservation (`GET /logout?redirect=...`). +2. Central SSO Application Launchpad (App Switcher) on `auth.atyg.org/dashboard` and post-login fallback. +3. Hybrid Ingress Routing Pattern & Developer Playbook for consumer applications (e.g. public landing vs private cockpit). +4. Comprehensive Additive Security & Regression Audit across all previously implemented subsystems. + +**Core Scope & Architectural Requirements to Explore:** + +1. **Logout Return-Path Preservation (`GET /logout`):** + * Update `ui/mod.ts` `/logout` handler so that when consumers trigger single-sign-out via `GET /logout?redirect=...`, the return URL is parsed and validated against the open-redirect whitelist (`*.atyg.org`, `localhost`, and relative paths). + * After successfully wiping Valkey session cache and revoking wildcard `.atyg.org` / host cookies, redirect the browser to `/login?redirect=${encodeURIComponent(safeRedirect)}` (or direct return) to keep consumer navigation intact without breaking UX. + +2. **Central SSO Application Launchpad (App Switcher):** + * When users log in directly on `auth.atyg.org/login` without a `?redirect=` parameter (or navigate to `/dashboard`), the default landing page must act as an intuitive SSO Launchpad. + * Query PostgreSQL `apps` and `grants` for the authenticated `userId` and render interactive application cards (e.g. ED-Droid Hub, Grafana Telemetry, Portainer Admin, IAM Console) with 1-click launch links and role indicators (`Admin`, `Operator`, `Viewer`). + * For Global Admins (`isGlobalAdmin = true`), display all fleet applications and direct links to user/grant management. + +3. **Hybrid Ingress Routing Pattern & Playbook:** + * Document and provide concrete reference configurations for consumer web applications that require hybrid public splash views alongside protected private cockpits. + * Clarify the dual-routing pattern: Traefik edge ForwardAuth protection for `/control-panel`, `/ws`, `/api/*` + App/SDK-level SSR hydration on root `/`. + +4. **Strict Additive Security & Regression Audit:** + * Ensure that adding dynamic launchpad tiles and logout redirect preservation introduces zero regressions or vulnerabilities: + - Open-Redirect Prevention (CWE-601): Absolute strict whitelist validation. + - Zero-Trust Default-Deny RBAC: Verify `isGlobalAdmin` and `getUserGrant` continue to strictly govern application tile visibility and ingress grant injection. + - RFC 9421 Edge Signatures, WebAuthn PRF (3.1), 2-of-3 SSS Recovery (3.3), and RFC 6962 Merkle Tree Audit Ledger (3.4) must remain 100% untouched and operational. + - Maintain 100% test coverage across all existing and new unit tests. + +**Your Task:** +1. Research the existing UI components in `ui/`, database schemas in `server/db.ts`, session handling in `server/auth-session.ts`, and redirect specs in `docs/FORWARDAUTH_REDIRECT_SPEC.md`. +2. Map out the `Target Files`, required UI component updates (`AppLaunchpadPage.tsx` / `SessionsPage.tsx`), route handlers in `ui/mod.ts`, and test cases in `server/main.test.ts`. +3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions, header metadata, and mandatory structure defined in `tasks/GUIDELINES.md`. +```