* Added `prf_enabled` and `prf_salt` columns to the `passkeys` table.
* Updated registration API endpoints to request and store the PRF extension capability and generate a secure salt.
* Updated the login API endpoints to map stored PRF salts into the `evalByCredential` array for the WebAuthn challenge.
* Enhanced the client-side WebAuthn SDK (`auth-client.js`) to extract the PRF Base64URL string output, decode it into a `Uint8Array`, and securely derive a 256-bit AES-GCM Key Encryption Key (KEK) via `crypto.subtle.deriveKey` using the `auth-yes:prf:device-share:v1` info string.
* Implemented graceful fallbacks throughout the stack to ensure registration and standard logins proceed if PRF is unsupported.
* Added corresponding unit tests to verify PRF flow and rejection logic.
* Verified visual and functional changes for the optional username input on the login page via Playwright scripts.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Expanded database schema to include `leaf_hash` in `audit_records` and added `audit_sths` table.
- Implemented `server/audit_merkle.ts` for native WebCrypto RFC 6962 tree computations and inclusion proofs.
- Created asynchronous micro-batcher in `server/audit.ts` to compute STH, sign with SPIFFE key, save to DB, and broadcast via Valkey.
- Refactored `auditLog` to compute leaf hashes synchronously before database inserts.
- Added hermetic unit tests with mock fallback patterns for SPIFFE/FFI in `server/audit_merkle.test.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Added a new task markdown file `2026-0824.01.jul.feat.webauthn.prf-extension-1200.md` detailing the plan for integrating the WebAuthn PRF extension. It outlines the schema updates, client and server flow implementations, and progressive fallback logic as per Kanban guidelines.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Adds a detailed markdown task file in `tasks/new/` following the Kanban guidelines to outline the architectural implementation plan for RFC 9421 HTTP Message Signatures verification at edge nodes using native Deno WebCrypto.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Created the task file for formalizing the Ghost Cockpit Protocol and its corresponding WebSocket guard helper in the SDK, adhering strictly to the required guidelines.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Add `domain` column to `apps` table.
- Create Valkey caching layers for app resolution by host (`auth:app_by_host:<host>`) and user grants (`auth:grants:<userId>:<appId>`) with PostgreSQL fallback in `server/auth-session.ts`.
- Update `/api/forward-auth` endpoint to resolve `X-Forwarded-Host`, enforce Default-Deny, check RBAC grants, and inject `X-Forwarded-*` scopes.
- Update relevant unit tests to cover missing and invalid scenarios with correct Mock stubs.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Added `argon2` v0.5 dependency to `spire_ffi/Cargo.toml`
- Implemented `argon2id_derive` FFI function in `spire_ffi/src/lib.rs` with C-ABI.
- Added Deno FFI binding `deriveArgon2idKey` in `server/spire_ffi.ts` with `nonblocking: true` to prevent stalling the event loop.
- Pre-allocates output buffer on the Deno side as the standard FFI pattern.
- Included fallback mock behavior when `libspire_ffi.so` is not loaded, returning a 32-byte 0xaa filled array.
- Updated unit tests in `server/spire_ffi.test.ts` to test mock usage and successful generation.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Added a lightweight, zero-dependency event bus to the `AuthSdk` to listen for Valkey RESP3 push invalidation events and emit them to registered listeners.
The implementation properly captures errors from synchronous and asynchronous listeners, ensuring they do not crash the primary SDK listener loop. Extracted the Valkey event processor to improve hermetic testability.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a new task markdown file in `tasks/new` detailing the
architecture and implementation steps required to inject
flattened RBAC grants via Valkey caching for `/api/forward-auth`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a Kanban task file outlining the architectural plan and
implementation steps for adding a zero-dependency real-time event
bus to `@auth-yes/sdk`. This bus will listen for Valkey RESP3 push
invalidation events and emit raw token strings to registered
listeners, ensuring safe and isolated execution to prevent downstream
crashes.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates a Kanban task file outlining the architectural plan and
implementation steps for adding a zero-dependency real-time event
bus to `@auth-yes/sdk`. This bus will listen for Valkey RESP3 push
invalidation events and emit raw token strings to registered
listeners, ensuring safe and isolated execution to prevent downstream
crashes.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
