tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
80 Commits 13 Branches 0 Tags
Commit Graph

7 Commits

Author SHA1 Message Date
google-labs-jules[bot]
97336a95be feat(server): add RFC 6962 Merkle Tree Audit Ledger 
- Expanded database schema to include `leaf_hash` in `audit_records` and added `audit_sths` table.
- Implemented `server/audit_merkle.ts` for native WebCrypto RFC 6962 tree computations and inclusion proofs.
- Created asynchronous micro-batcher in `server/audit.ts` to compute STH, sign with SPIFFE key, save to DB, and broadcast via Valkey.
- Refactored `auditLog` to compute leaf hashes synchronously before database inserts.
- Added hermetic unit tests with mock fallback patterns for SPIFFE/FFI in `server/audit_merkle.test.ts`.

Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
 2026-08-24 06:19:23 +00:00
google-labs-jules[bot]
182c789e05 feat(auth): implement RFC 9421 HTTP Message Signatures 
- Added native Deno WebCrypto Ed25519 signature verification middleware for headless edge workloads.
- Integrated dual authentication path to `/api/forward-auth` processing signatures and session cookies.
- Added dual storage Admin Management routes (`/api/admin/hwk`) securely inserting directly to PostgreSQL and pushing to $O(1)$ Valkey verification set.
- Completed all quality gates checks and hermetic mocked tests successfully.

Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
 2026-08-24 05:36:01 +00:00
google-labs-jules[bot]
8ff5090ffa feat: Implement Ingress Grant Vector Injection for ForwardAuth 
- Add `domain` column to `apps` table.
- Create Valkey caching layers for app resolution by host (`auth:app_by_host:<host>`) and user grants (`auth:grants:<userId>:<appId>`) with PostgreSQL fallback in `server/auth-session.ts`.
- Update `/api/forward-auth` endpoint to resolve `X-Forwarded-Host`, enforce Default-Deny, check RBAC grants, and inject `X-Forwarded-*` scopes.
- Update relevant unit tests to cover missing and invalid scenarios with correct Mock stubs.

Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
 2026-08-24 04:23:04 +00:00
Tyler Gillispie
40da6ecbe0 fix(infra): update Dockerfile, setup.ts, and bootstrap admin invite for standalone repo 2026-08-22 10:18:47 -07:00
Tyler Gillispie
623e78a7b1 fix(tests): guard valkey.disconnect and format files 2026-08-21 17:31:36 -07:00
google-labs-jules[bot]
9988df3218 audit: verify 3-tier auth, rbac, and decouple server side effects 
- Add `app` export and wrap startup logic behind `if (import.meta.main)`
- Extract `hono` middleware into `sdk/hono.ts` for clean separation
- Refactor module imports slightly to support in-memory native mocking (`db`, `valkey`, `spire_ffi`, `ratelimit`, `audit`)
- Implement comprehensive native Deno mock tests in `server/main.test.ts`
- Fix type checking across project files

Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
 2026-08-22 00:29:19 +00:00
Tyler Gillispie
ac89e4c8d0 feat: initial commit for auth-yes identity hub 2026-08-21 14:27:36 -07:00