auth-yes/docs/V3_PROGRESS_TRACKER.md

V3 IAM & Web UI Progress Tracker

This document tracks all completed and pending tasks across the Identity Provider backend, zero-trust mesh, and administrative Web UI as defined in V3_AUDIT_REPORT.md and Custom IAM Architecture Analysis v2.md.

---

1. Phase 1: Core Engine, Passkeys & Session Infrastructure

• WebAuthn Registration & Login Engine: Asymmetric challenge/response verification via SimpleWebAuthn.
• Hybrid Passkey Support: Software authenticators (iPhones, Android, Windows Hello, 1Password) supported by default with optional strict hardware enforcement (REQUIRE_HARDWARE_TOKEN=true).
• PostgreSQL Auto-Initialization: Schema auto-init on boot (users, apps, grants, invites, passkeys, sessions, audit_records, aaguid_allowlist).
• Dual-Layer Session Management: Microsecond Valkey cache verification with automatic PostgreSQL sessions fallback to protect against cache evictions on container restarts.
• Zero-Loopback Direct SSR: Replaced all error-prone internal fetch('127.0.0.1:8000') calls in UI routes with direct, in-process database & session helpers.
• Distributed Rate Limiting: Valkey-backed sliding-window rate limiters on public and administrative endpoints.
• Asynchronous Security Audit Logging: Fire-and-forget structured audit logger capturing origin IP addresses and event telemetry.

---

2. Phase 2: Zero-Trust App Mesh & Cryptographic Workloads

• ConnectRPC / gRPC Migration: Replaced unauthenticated HTTP validation with high-throughput ConnectRPC services over HTTP/2 multiplexing.
• SPIFFE/SPIRE mTLS Authentication: Securely extracted SPIFFE IDs from incoming client certificates via custom spire_ffi Rust FFI and ASN.1 certificate parsing.
• Default-Deny RBAC Engine: Backend validation requiring an explicit active matching row in the grants table for (user_id, app_id).
• Expanded ConnectRPC Payload: Configured AuthService.validateSession to return granular application roles in the scopes array (scopes: [grantRecord.role]).

---

3. Phase 3: Developer Experience & Build Optimization

• Monorepo Workspace Management: Configured root deno.json with workspace tasks (check, lint, test, fmt).
• Docker Build Layer Caching: Created dedicated auth-yes/deps.ts layer in auth-yes/Dockerfile ensuring subsequent image builds take ~1 second instead of re-downloading JSR/npm packages.
• Client-Side WebAuthn UX: Clean error banner reporting on UI pages and safe JSON parsing in auth-client.js.

---

4. Phase 4: Administrative UI Workflows (Current Execution Phase)

Completed UI Views:

• User Directory (/admin/users): View all registered users, display names, and trigger status updates (Activate, Suspend, Re-Activate).
• User Profile & Device Recovery (/admin/users/:id): Active sessions list & revocation, passkey device deletion, and 24h Out-of-Band recovery link generation.
• Application Registry View (/admin/apps):
  • Render table of registered applications (name, spiffe_id, description, created_at, active_grants_count).
  • Add Register Application form (name, spiffe_id, description).
  • Add Delete Application action with confirmation modal.
  • Expose /api/admin/apps REST endpoints (GET, POST, DELETE).
• Role & Permission Catalog (/admin/roles):
  • PostgreSQL roles table with Global (app_id IS NULL) vs App-Specific (app_id UUID) scoping.
  • Auto-seeded standard core roles (admin, editor, operator, viewer).
  • Role management interface with scope filter (All, Global Only, or By App).
  • Expose /api/admin/roles REST endpoints (GET, POST, DELETE).
• Multi-Type & Multi-Use Invite Token Manager (/admin/invites):
  • Token Generation Form with 3 Provisioning Types (Global Admin, Site-Scoped, Open/Pending).
  • 3 Usage Policy Modes: Single-Use (1 Person), Limited Multi-Use (Cap at N People), Unlimited Time-Bound (Campaign / Beta).
  • Auto-Activate vs Require Approval account enrollment toggle.
  • Expiration duration selector (1 to 30 days, default 7 days) & Custom Code support.
  • Live Invites Ledger displaying real-time usage progress bars (X / Y used), status (Active, Exhausted, Expired), and activation state.
  • Redemption Audit Ledger (invite_redemptions table) and modal viewer (Claimed (N)) tracking all users and timestamps per token.
  • Single-click Copy Registration URL and Revoke buttons.
• User App RBAC Grants Matrix (/admin/users/:id):
  • Display matrix / table of currently assigned application access (App Name, Role, Granted At).
  • Add Grant form: Dropdown app selector + dynamic role selector populated from Role Catalog + Save Grant button.
  • Revoke Grant action button to instantly strip application access.
  • Expose /api/admin/users/:id/grants REST endpoints (GET, POST, DELETE).
• AAGUID Allow-List Management (/admin/aaguid): View approved hardware authenticators and add new AAGUIDs.
• System Audit Log Viewer (/admin/audit-logs): Real-time security and administrative telemetry table.
• User Dashboard Navigation (AuthenticatedLayout.tsx & AdminLayout.tsx): Seamless navigation between Dashboard, Sessions, Passkeys, Users, Applications, Roles, Invite Tokens, AAGUID, and Audit Logs.

---

5. Phase 5: Edge Proxy Hardening & ForwardAuth Integration

• Domain Wildcard Cookie: Configured cookie issuing in auth-yes/server/main.ts with domain: cookieDomain (.atyg.org) for seamless cross-subdomain sharing.
• Traefik ForwardAuth Route (/api/forward-auth): Implemented GET /api/forward-auth to validate incoming .atyg.org session cookies in Valkey/DB and inject X-Forwarded-User headers for Tier 2 legacy apps (Portainer, Grafana, etc.).
• Traefik Tier 1 Default Middleware Configuration: Define default ForwardAuth middleware in Traefik entrypoints to protect untagged/pre-release containers.