- Add `domain` column to `apps` table.
- Create Valkey caching layers for app resolution by host (`auth:app_by_host:<host>`) and user grants (`auth:grants:<userId>:<appId>`) with PostgreSQL fallback in `server/auth-session.ts`.
- Update `/api/forward-auth` endpoint to resolve `X-Forwarded-Host`, enforce Default-Deny, check RBAC grants, and inject `X-Forwarded-*` scopes.
- Update relevant unit tests to cover missing and invalid scenarios with correct Mock stubs.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a new task markdown file in `tasks/new` detailing the
architecture and implementation steps required to inject
flattened RBAC grants via Valkey caching for `/api/forward-auth`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a Kanban task file outlining the architectural plan and
implementation steps for adding a zero-dependency real-time event
bus to `@auth-yes/sdk`. This bus will listen for Valkey RESP3 push
invalidation events and emit raw token strings to registered
listeners, ensuring safe and isolated execution to prevent downstream
crashes.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
This implements custom Alpine-based Smart SPIRE Server and Agent Docker
images with self-seeding configuration entrypoints. It also updates
the docker-compose configuration to utilize a single host storage volume
and a dedicated named socket volume. Setup build pipelines are expanded to
compile and push these custom SPIRE images.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a task file outlining the automated testing strategy for the
Auth-Yes platform. The plan covers testing strategies for Tier 1 & 2
(Traefik ForwardAuth), Tier 3 (ConnectRPC with SPIFFE/mTLS), RBAC
Default-Deny, and the @auth-yes/sdk Hono middleware using Deno native
mocking capabilities, strictly avoiding external Docker dependencies.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
