128 lines
6.5 KiB
Markdown
128 lines
6.5 KiB
Markdown
# V3 IAM & Web UI Progress Tracker
|
|
|
|
This document tracks all completed and pending tasks across the Identity
|
|
Provider backend, zero-trust mesh, and administrative Web UI as defined in
|
|
[`V3_AUDIT_REPORT.md`](file:///home/tylerg/p/data/ed-droid/V3_AUDIT_REPORT.md)
|
|
and
|
|
[`Custom IAM Architecture Analysis v2.md`](file:///home/tylerg/p/data/ed-droid/auth-yes/Custom%20IAM%20Architecture%20Analysis%20v2.md).
|
|
|
|
---
|
|
|
|
## 1. Phase 1: Core Engine, Passkeys & Session Infrastructure
|
|
|
|
- [x] **WebAuthn Registration & Login Engine:** Asymmetric challenge/response
|
|
verification via SimpleWebAuthn.
|
|
- [x] **Hybrid Passkey Support:** Software authenticators (iPhones, Android,
|
|
Windows Hello, 1Password) supported by default with optional strict
|
|
hardware enforcement (`REQUIRE_HARDWARE_TOKEN=true`).
|
|
- [x] **PostgreSQL Auto-Initialization:** Schema auto-init on boot (`users`,
|
|
`apps`, `grants`, `invites`, `passkeys`, `sessions`, `audit_records`,
|
|
`aaguid_allowlist`).
|
|
- [x] **Dual-Layer Session Management:** Microsecond Valkey cache verification
|
|
with automatic PostgreSQL `sessions` fallback to protect against cache
|
|
evictions on container restarts.
|
|
- [x] **Zero-Loopback Direct SSR:** Replaced all error-prone internal
|
|
`fetch('127.0.0.1:8000')` calls in UI routes with direct, in-process
|
|
database & session helpers.
|
|
- [x] **Distributed Rate Limiting:** Valkey-backed sliding-window rate limiters
|
|
on public and administrative endpoints.
|
|
- [x] **Asynchronous Security Audit Logging:** Fire-and-forget structured audit
|
|
logger capturing origin IP addresses and event telemetry.
|
|
|
|
---
|
|
|
|
## 2. Phase 2: Zero-Trust App Mesh & Cryptographic Workloads
|
|
|
|
- [x] **ConnectRPC / gRPC Migration:** Replaced unauthenticated HTTP validation
|
|
with high-throughput ConnectRPC services over HTTP/2 multiplexing.
|
|
- [x] **SPIFFE/SPIRE mTLS Authentication:** Securely extracted SPIFFE IDs from
|
|
incoming client certificates via custom `spire_ffi` Rust FFI and ASN.1
|
|
certificate parsing.
|
|
- [x] **Default-Deny RBAC Engine:** Backend validation requiring an explicit
|
|
active matching row in the `grants` table for `(user_id, app_id)`.
|
|
- [x] **Expanded ConnectRPC Payload:** Configured `AuthService.validateSession`
|
|
to return granular application roles in the `scopes` array
|
|
(`scopes: [grantRecord.role]`).
|
|
|
|
---
|
|
|
|
## 3. Phase 3: Developer Experience & Build Optimization
|
|
|
|
- [x] **Monorepo Workspace Management:** Configured root `deno.json` with
|
|
workspace tasks (`check`, `lint`, `test`, `fmt`).
|
|
- [x] **Docker Build Layer Caching:** Created dedicated `auth-yes/deps.ts` layer
|
|
in `auth-yes/Dockerfile` ensuring subsequent image builds take ~1 second
|
|
instead of re-downloading JSR/npm packages.
|
|
- [x] **Client-Side WebAuthn UX:** Clean error banner reporting on UI pages and
|
|
safe JSON parsing in `auth-client.js`.
|
|
|
|
---
|
|
|
|
## 4. Phase 4: Administrative UI Workflows (Current Execution Phase)
|
|
|
|
### Completed UI Views:
|
|
|
|
- [x] **User Directory (`/admin/users`):** View all registered users, display
|
|
names, and trigger status updates (_Activate_, _Suspend_, _Re-Activate_).
|
|
- [x] **User Profile & Device Recovery (`/admin/users/:id`):** Active sessions
|
|
list & revocation, passkey device deletion, and 24h Out-of-Band recovery
|
|
link generation.
|
|
- [x] **Application Registry View (`/admin/apps`):**
|
|
- [x] Render table of registered applications (`name`, `spiffe_id`,
|
|
`description`, `created_at`, `active_grants_count`).
|
|
- [x] Add _Register Application_ form (`name`, `spiffe_id`, `description`).
|
|
- [x] Add _Delete Application_ action with confirmation modal.
|
|
- [x] Expose `/api/admin/apps` REST endpoints (GET, POST, DELETE).
|
|
- [x] **Role & Permission Catalog (`/admin/roles`):**
|
|
- [x] PostgreSQL `roles` table with Global (`app_id IS NULL`) vs App-Specific
|
|
(`app_id UUID`) scoping.
|
|
- [x] Auto-seeded standard core roles (`admin`, `editor`, `operator`,
|
|
`viewer`).
|
|
- [x] Role management interface with scope filter (_All_, _Global Only_, or
|
|
_By App_).
|
|
- [x] Expose `/api/admin/roles` REST endpoints (GET, POST, DELETE).
|
|
- [x] **Multi-Type & Multi-Use Invite Token Manager (`/admin/invites`):**
|
|
- [x] Token Generation Form with 3 Provisioning Types (Global Admin,
|
|
Site-Scoped, Open/Pending).
|
|
- [x] 3 Usage Policy Modes: Single-Use (1 Person), Limited Multi-Use (Cap at N
|
|
People), Unlimited Time-Bound (Campaign / Beta).
|
|
- [x] Auto-Activate vs Require Approval account enrollment toggle.
|
|
- [x] Expiration duration selector (1 to 30 days, default 7 days) & Custom
|
|
Code support.
|
|
- [x] Live Invites Ledger displaying real-time usage progress bars
|
|
(`X / Y used`), status (`Active`, `Exhausted`, `Expired`), and
|
|
activation state.
|
|
- [x] Redemption Audit Ledger (`invite_redemptions` table) and modal viewer
|
|
(`Claimed (N)`) tracking all users and timestamps per token.
|
|
- [x] Single-click _Copy Registration URL_ and _Revoke_ buttons.
|
|
- [x] **User App RBAC Grants Matrix (`/admin/users/:id`):**
|
|
- [x] Display matrix / table of currently assigned application access
|
|
(`App Name`, `Role`, `Granted At`).
|
|
- [x] Add Grant form: Dropdown app selector + dynamic role selector populated
|
|
from Role Catalog + _Save Grant_ button.
|
|
- [x] Revoke Grant action button to instantly strip application access.
|
|
- [x] Expose `/api/admin/users/:id/grants` REST endpoints (GET, POST, DELETE).
|
|
- [x] **AAGUID Allow-List Management (`/admin/aaguid`):** View approved hardware
|
|
authenticators and add new AAGUIDs.
|
|
- [x] **System Audit Log Viewer (`/admin/audit-logs`):** Real-time security and
|
|
administrative telemetry table.
|
|
- [x] **User Dashboard Navigation (`AuthenticatedLayout.tsx` &
|
|
`AdminLayout.tsx`):** Seamless navigation between _Dashboard_, _Sessions_,
|
|
_Passkeys_, _Users_, _Applications_, _Roles_, _Invite Tokens_, _AAGUID_,
|
|
and _Audit Logs_.
|
|
|
|
---
|
|
|
|
## 5. Phase 5: Edge Proxy Hardening & ForwardAuth Integration
|
|
|
|
- [x] **Domain Wildcard Cookie:** Configured cookie issuing in
|
|
`auth-yes/server/main.ts` with `domain: cookieDomain` (`.atyg.org`) for
|
|
seamless cross-subdomain sharing.
|
|
- [x] **Traefik ForwardAuth Route (`/api/forward-auth`):** Implemented
|
|
`GET /api/forward-auth` to validate incoming `.atyg.org` session cookies
|
|
in Valkey/DB and inject `X-Forwarded-User` headers for Tier 2 legacy apps
|
|
(Portainer, Grafana, etc.).
|
|
- [ ] **Traefik Tier 1 Default Middleware Configuration:** Define default
|
|
ForwardAuth middleware in Traefik entrypoints to protect
|
|
untagged/pre-release containers.
|