- Add `domain` column to `apps` table.
- Create Valkey caching layers for app resolution by host (`auth:app_by_host:<host>`) and user grants (`auth:grants:<userId>:<appId>`) with PostgreSQL fallback in `server/auth-session.ts`.
- Update `/api/forward-auth` endpoint to resolve `X-Forwarded-Host`, enforce Default-Deny, check RBAC grants, and inject `X-Forwarded-*` scopes.
- Update relevant unit tests to cover missing and invalid scenarios with correct Mock stubs.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a new task markdown file in `tasks/new` detailing the
architecture and implementation steps required to inject
flattened RBAC grants via Valkey caching for `/api/forward-auth`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a Kanban task file outlining the architectural plan and
implementation steps for adding a zero-dependency real-time event
bus to `@auth-yes/sdk`. This bus will listen for Valkey RESP3 push
invalidation events and emit raw token strings to registered
listeners, ensuring safe and isolated execution to prevent downstream
crashes.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a Kanban task file outlining the architectural plan and
implementation steps for adding a zero-dependency real-time event
bus to `@auth-yes/sdk`. This bus will listen for Valkey RESP3 push
invalidation events and emit raw token strings to registered
listeners, ensuring safe and isolated execution to prevent downstream
crashes.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
feat: Implement SPIRE Smart Image Packaging & Single Volume Bootstrap
Added spire/Dockerfile.server and spire/Dockerfile.agent wrapping upstream ghcr.io/spiffe images.
Added self-seeding entrypoint scripts handling template provisioning and stale socket cleanup.
Added generic, commented HCL templates for server.conf and agent.conf.
Simplified infra/setup.ts to output a cleaner compose.spire.yml with one spire-data host bind and one spire-socket named volume, eliminating spire-init.
Updated CLI build commands to include SPIRE images.
Task marked as complete.
This implements custom Alpine-based Smart SPIRE Server and Agent Docker
images with self-seeding configuration entrypoints. It also updates
the docker-compose configuration to utilize a single host storage volume
and a dedicated named socket volume. Setup build pipelines are expanded to
compile and push these custom SPIRE images.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a task file outlining the automated testing strategy for the
Auth-Yes platform. The plan covers testing strategies for Tier 1 & 2
(Traefik ForwardAuth), Tier 3 (ConnectRPC with SPIFFE/mTLS), RBAC
Default-Deny, and the @auth-yes/sdk Hono middleware using Deno native
mocking capabilities, strictly avoiding external Docker dependencies.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
