# V3 IAM & Web UI Progress Tracker

This document tracks all completed and pending tasks across the Identity
Provider backend, zero-trust mesh, and administrative Web UI as defined in
[`V3_AUDIT_REPORT.md`](file:///home/tylerg/p/data/ed-droid/V3_AUDIT_REPORT.md)
and
[`Custom IAM Architecture Analysis v2.md`](file:///home/tylerg/p/data/ed-droid/auth-yes/Custom%20IAM%20Architecture%20Analysis%20v2.md).

---

## 1. Phase 1: Core Engine, Passkeys & Session Infrastructure

- [x] **WebAuthn Registration & Login Engine:** Asymmetric challenge/response
      verification via SimpleWebAuthn.
- [x] **Hybrid Passkey Support:** Software authenticators (iPhones, Android,
      Windows Hello, 1Password) supported by default with optional strict
      hardware enforcement (`REQUIRE_HARDWARE_TOKEN=true`).
- [x] **PostgreSQL Auto-Initialization:** Schema auto-init on boot (`users`,
      `apps`, `grants`, `invites`, `passkeys`, `sessions`, `audit_records`,
      `aaguid_allowlist`).
- [x] **Dual-Layer Session Management:** Microsecond Valkey cache verification
      with automatic PostgreSQL `sessions` fallback to protect against cache
      evictions on container restarts.
- [x] **Zero-Loopback Direct SSR:** Replaced all error-prone internal
      `fetch('127.0.0.1:8000')` calls in UI routes with direct, in-process
      database & session helpers.
- [x] **Distributed Rate Limiting:** Valkey-backed sliding-window rate limiters
      on public and administrative endpoints.
- [x] **Asynchronous Security Audit Logging:** Fire-and-forget structured audit
      logger capturing origin IP addresses and event telemetry.

---

## 2. Phase 2: Zero-Trust App Mesh & Cryptographic Workloads

- [x] **ConnectRPC / gRPC Migration:** Replaced unauthenticated HTTP validation
      with high-throughput ConnectRPC services over HTTP/2 multiplexing.
- [x] **SPIFFE/SPIRE mTLS Authentication:** Securely extracted SPIFFE IDs from
      incoming client certificates via custom `spire_ffi` Rust FFI and ASN.1
      certificate parsing.
- [x] **Default-Deny RBAC Engine:** Backend validation requiring an explicit
      active matching row in the `grants` table for `(user_id, app_id)`.
- [x] **Expanded ConnectRPC Payload:** Configured `AuthService.validateSession`
      to return granular application roles in the `scopes` array
      (`scopes: [grantRecord.role]`).

---

## 3. Phase 3: Developer Experience & Build Optimization

- [x] **Monorepo Workspace Management:** Configured root `deno.json` with
      workspace tasks (`check`, `lint`, `test`, `fmt`).
- [x] **Docker Build Layer Caching:** Created dedicated `auth-yes/deps.ts` layer
      in `auth-yes/Dockerfile` ensuring subsequent image builds take ~1 second
      instead of re-downloading JSR/npm packages.
- [x] **Client-Side WebAuthn UX:** Clean error banner reporting on UI pages and
      safe JSON parsing in `auth-client.js`.

---

## 4. Phase 4: Administrative UI Workflows (Current Execution Phase)

### Completed UI Views:

- [x] **User Directory (`/admin/users`):** View all registered users, display
      names, and trigger status updates (_Activate_, _Suspend_, _Re-Activate_).
- [x] **User Profile & Device Recovery (`/admin/users/:id`):** Active sessions
      list & revocation, passkey device deletion, and 24h Out-of-Band recovery
      link generation.
- [x] **Application Registry View (`/admin/apps`):**
  - [x] Render table of registered applications (`name`, `spiffe_id`,
        `description`, `created_at`, `active_grants_count`).
  - [x] Add _Register Application_ form (`name`, `spiffe_id`, `description`).
  - [x] Add _Delete Application_ action with confirmation modal.
  - [x] Expose `/api/admin/apps` REST endpoints (GET, POST, DELETE).
- [x] **Role & Permission Catalog (`/admin/roles`):**
  - [x] PostgreSQL `roles` table with Global (`app_id IS NULL`) vs App-Specific
        (`app_id UUID`) scoping.
  - [x] Auto-seeded standard core roles (`admin`, `editor`, `operator`,
        `viewer`).
  - [x] Role management interface with scope filter (_All_, _Global Only_, or
        _By App_).
  - [x] Expose `/api/admin/roles` REST endpoints (GET, POST, DELETE).
- [x] **Multi-Type & Multi-Use Invite Token Manager (`/admin/invites`):**
  - [x] Token Generation Form with 3 Provisioning Types (Global Admin,
        Site-Scoped, Open/Pending).
  - [x] 3 Usage Policy Modes: Single-Use (1 Person), Limited Multi-Use (Cap at N
        People), Unlimited Time-Bound (Campaign / Beta).
  - [x] Auto-Activate vs Require Approval account enrollment toggle.
  - [x] Expiration duration selector (1 to 30 days, default 7 days) & Custom
        Code support.
  - [x] Live Invites Ledger displaying real-time usage progress bars
        (`X / Y used`), status (`Active`, `Exhausted`, `Expired`), and
        activation state.
  - [x] Redemption Audit Ledger (`invite_redemptions` table) and modal viewer
        (`Claimed (N)`) tracking all users and timestamps per token.
  - [x] Single-click _Copy Registration URL_ and _Revoke_ buttons.
- [x] **User App RBAC Grants Matrix (`/admin/users/:id`):**
  - [x] Display matrix / table of currently assigned application access
        (`App Name`, `Role`, `Granted At`).
  - [x] Add Grant form: Dropdown app selector + dynamic role selector populated
        from Role Catalog + _Save Grant_ button.
  - [x] Revoke Grant action button to instantly strip application access.
  - [x] Expose `/api/admin/users/:id/grants` REST endpoints (GET, POST, DELETE).
- [x] **AAGUID Allow-List Management (`/admin/aaguid`):** View approved hardware
      authenticators and add new AAGUIDs.
- [x] **System Audit Log Viewer (`/admin/audit-logs`):** Real-time security and
      administrative telemetry table.
- [x] **User Dashboard Navigation (`AuthenticatedLayout.tsx` &
      `AdminLayout.tsx`):** Seamless navigation between _Dashboard_, _Sessions_,
      _Passkeys_, _Users_, _Applications_, _Roles_, _Invite Tokens_, _AAGUID_,
      and _Audit Logs_.

---

## 5. Phase 5: Edge Proxy Hardening & ForwardAuth Integration

- [x] **Domain Wildcard Cookie:** Configured cookie issuing in
      `auth-yes/server/main.ts` with `domain: cookieDomain` (`.atyg.org`) for
      seamless cross-subdomain sharing.
- [x] **Traefik ForwardAuth Route (`/api/forward-auth`):** Implemented
      `GET /api/forward-auth` to validate incoming `.atyg.org` session cookies
      in Valkey/DB and inject `X-Forwarded-User` headers for Tier 2 legacy apps
      (Portainer, Grafana, etc.).
- [ ] **Traefik Tier 1 Default Middleware Configuration:** Define default
      ForwardAuth middleware in Traefik entrypoints to protect
      untagged/pre-release containers.