- Role 1: XID as OIDC/OAuth IdP for customer applications, SDKs, and resource servers. Current source-map rows include OAuth discovery metadata, authorization code, token, userinfo, JWKS, PAR, DPoP, RAR, JAR, JARM, introspection, revocation, and token/session evidence.
- Role 2: XID as enterprise upstream IdP SAML SP/OIDC RP. Current source-map rows include SAML metadata, SAML ACS, SAML JIT, OIDC enterprise JIT, LDAP direct bind, WS-Federation, SWA password vaulting, header-based SSO, directory connector framework, provider compatibility rows for Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, PingOne, PingFederate, AD FS, Shibboleth, and Keycloak, and public
/enterprise-ssoplus/samlboundary text. Auth0 Enterprise Connections, Clerk Enterprise SSO, and Zitadel identity brokering confirm this role class. LDAP direct bind, WS-Federation, SWA password vaulting, header-based SSO, and directory connector framework are implemented locally; linked sign-on and native IWA/Kerberos remain outside XID support; Kerberos deployment pattern is documented only. - Role 3: XID as downstream SaaS SAML/OIDC IdP. Current source-map rows include Outbound SAML IdP metadata, Outbound SAML IdP SSO endpoint, Slack downstream SAML template, GitHub Enterprise downstream SAML template, Downstream OIDC app catalog, Microsoft custom enterprise app downstream SSO, Atlassian downstream SAML template, Salesforce downstream SAML/OIDC template, Zoom downstream SAML/OIDC template, and Outbound SAML SLO. Outbound SAML metadata and SSO baseline are implemented with fake SaaS SP L3; downstream OIDC app catalog is implemented on the generic OIDC/OAuth IdP baseline with fake SaaS OIDC RP callback L3. Public docs use
/enterprise-ssofor the SaaS SSO boundary and/samlor/oidc-oauthfor protocol details. Real Slack/GitHub/Microsoft/Atlassian/Salesforce/Zoom L4 is still missing and no production-supported claim is made. Auth0 outbound SSO confirms this is a separate product surface with IdP-initiated marketplace integrations like Slack and Zoom plus custom SAML or OIDC. Clerk OAuth SSO as Clerk acting as OAuth 2.0/OIDC IdP proves generic IdP role only, not SaaS app catalog production support. Slack requires ACS URLhttps://yourdomain.slack.com/sso/saml, Entity IDhttps://slack.com, HTTP POST binding only, signed SAML Response, NameID, User.Email, and no Single Logout. GitHub Enterprise Cloud requires an external IdP connected to a GitHub Enterprise Cloud organization; GitHub Enterprise Managed Users OIDC is an Entra ID partner path and is not generic downstream OIDC support for XID. - Role 4: XID as SCIM Service Provider. Current source-map rows include SCIM ServiceProviderConfig, SCIM Schemas and ResourceTypes, SCIM Users, SCIM Groups, SCIM PATCH and error model, Directory bearer token, competitor SCIM boundary coverage, downstream SaaS SCIM target boundary coverage, and public
/scimboundary text. Auth0 Inbound SCIM and Clerk Directory Sync are inbound SCIM Service Provider evidence. Auth0 Inbound SCIM does not support a full/groupsendpoint, while XID local evidence includes Users and Groups but still lacks real IdP provisioning L4. Auth0 SCIM deactivation terminates Auth0 sessions, revokes refresh tokens, and can trigger OIDC Back-Channel Logout when configured; Clerk Directory Sync also revokes active sessions on deprovisioning. Okta AIW SCIM provisioning requires SAML or SWA, not OIDC. Microsoft Entra SCIM Test Connection expects HTTP 200 with an empty ListResponse for a non-existent user, assigned user/group sync cycles run about every 40 minutes, and gallery onboarding expects SCIM user/group endpoints, schema discovery, PATCH group membership, and OAuth 2.0 client credentials. Zitadel Okta SCIM is Okta-to-ZITADEL inbound provisioning with service-account authentication andhttps://${ZITADEL_DOMAIN}/scim/v2/{orgId}. Slack SCIM is a downstream target API at/scim/v2with anadminscope Bearer OAuth token and Enterprise org install requirements. GitHub Enterprise Managed Users SCIM is IdP-to-GitHub lifecycle management, and REST API SCIM is not supported with enterprises enabled for OIDC. XID outbound SCIM client baseline has fake SaaS SCIM target L3, but inbound SCIM evidence cannot be reused as Slack or GitHub push-to-SaaS L4. - Role 5: XID as Social OAuth RP. Current source-map rows include GitHub social OAuth provider, Google social OAuth provider, Apple social OAuth provider, Microsoft account social OAuth provider, and public
/social-loginboundary text.
Goal completion gate: source-map coverage can prove role-line documentation and local evidence alignment. Local protocol implementation can be completed with fake provider or fake SaaS L3. Real provider/IdP/SaaS L4 is required only for production-supported claims. Role 2, role 4 inbound L4, role 5, role 3 SaaS-specific production support, and downstream SaaS SCIM target production support still need real external inputs.
Production evidence rule: every L4 result must record the tested commit, active Worker version, callback or provider transaction identifier, de-identified result, and cleanup result. A local L1-L3 test, a Workers Build record, or a deployment command alone is not L4 evidence. When Cloudflare read access, an external provider credential, a test tenant, or an approved receiving address is absent, the row must be marked BLOCKED with the exact missing input.
| Feature | Standard source | Support | Evidence | Code path | Test path | Public docs path | i18n msgid path | Production evidence |
|---|---|---|---|---|---|---|---|---|
| OAuth discovery metadata | RFC 8414, OIDC Discovery 1.0 | implemented | L1/L2 | packages/protocol/src/discovery.ts; apps/server/worker/oidc/discovery.ts |
packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
active Worker deployment recorded in README.md |
| JWKS | OIDC Core 1.0, JWK | implemented | L1/L2 | apps/server/worker/oidc/jwks.ts; packages/crypto/src/jwks.ts |
apps/server/worker/oidc/__tests__/discovery.test.ts; packages/crypto/src/__tests__/jwks.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
JWKS route and package tests verify public key output and no private key fields; not L4 claimed here |
| JWKS cache | OIDC Discovery, JWK | implemented | L1/L2 | apps/server/worker/oidc/jwks.ts; apps/server/worker/oidc/discovery.ts |
apps/server/worker/oidc/__tests__/discovery.test.ts; packages/crypto/src/__tests__/jwks.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
KV cache route tests cover cached JWKS response shape; not L4 claimed here |
| Authorization code | RFC 6749 | implemented | L1/L2/L3 | apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-grants.ts; packages/protocol/src/authorize.ts |
apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; packages/protocol/src/__tests__/authorize.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
local L3 protocol client smoke covers PAR-backed code flow against dev server; not L4 claimed here |
| Client credentials | RFC 6749 | implemented | L1/L2 | apps/server/worker/oidc/token-grants.ts; apps/server/worker/oidc/client-auth.ts |
apps/server/worker/oidc/__tests__/token-security.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
confidential client grant route tests cover client authentication and token issuance; not L4 claimed here |
| PKCE S256 | RFC 7636, OAuth 2.1 draft | implemented | L1/L2 | packages/protocol/src/pkce.ts; packages/protocol/src/authorize.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-grants.ts |
packages/protocol/src/__tests__/pkce.test.ts; packages/protocol/src/__tests__/pkce-verify.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
protocol helpers and authorize/token route tests reject plain and verify S256; not L4 claimed here |
| Redirect URI exact match | RFC 6749, RFC 9700 | implemented | L1/L2 | packages/protocol/src/authorize.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-grants.ts |
packages/protocol/src/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
authorize and token route tests cover exact redirect matching; not L4 claimed here |
| State nonce and mix-up protection | RFC 9207, OIDC Core 1.0 | implemented | L1/L2 | apps/server/worker/oidc/authorize.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/durable-objects/oauth-flow-do.ts |
apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/durable-objects/__tests__/oauth-flow-do.test.ts |
/oidc-oauth; /saml |
packages/i18n/locales/**/messages.po |
authorization response iss, state echo, nonce carry-forward, and OIDC upstream state consumption are local route evidence only; not L4 claimed here |
| Nonce | OIDC Core 1.0 | implemented | L1/L2 | apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-grants.ts; apps/server/worker/oidc/token-issue.ts; packages/protocol/src/authorize.ts; packages/protocol/src/tokens.ts |
packages/protocol/src/__tests__/authorize.test.ts; packages/protocol/src/__tests__/tokens.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
authorize and token route tests cover nonce persistence into id_token; not L4 claimed here |
| Authorization code one-time use | RFC 6749, RFC 9700 | implemented | L1/L2 | apps/server/worker/oidc/token-grants.ts; packages/db/src/schema/oauth.ts |
apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
token route consumes authorization code with conditional update and revokes related refresh family on replay; not L4 claimed here |
| Refresh rotation and replay detection | RFC 9700 | implemented | L1/L2 | apps/server/worker/oidc/token-grants.ts; packages/protocol/src/refresh.ts; packages/db/src/schema/oauth.ts |
packages/protocol/src/__tests__/refresh.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
token route rotates refresh tokens and marks family revoked on replay; not L4 claimed here |
| Refresh token hash storage | RFC 9700 | implemented | L1/L2 | packages/protocol/src/refresh.ts; apps/server/worker/oidc/token-grants.ts |
packages/protocol/src/__tests__/refresh.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
refresh tokens are stored as hashes in local protocol and route evidence; not L4 claimed here |
| Refresh family revoke | RFC 9700 | implemented | L1/L2 | apps/server/worker/oidc/token-grants.ts; packages/protocol/src/refresh.ts; packages/db/src/schema/oauth.ts |
packages/protocol/src/__tests__/refresh.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
reuse detection revokes the refresh family in route tests; not L4 claimed here |
| Refresh auth context carry-forward | OIDC Core 1.0 | implemented | L1/L2 | packages/protocol/src/refresh.ts; packages/db/src/schema/oauth.ts; apps/server/worker/oidc/token-grants.ts; apps/server/worker/oidc/token-issue.ts |
packages/protocol/src/__tests__/refresh.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
refresh route tests preserve ACR/AMR/auth_time into refreshed tokens; not L4 claimed here |
| RFC9207 issuer response | RFC 9207 | implemented | L1/L2 | apps/server/worker/oidc/authorize.ts |
apps/server/worker/oidc/__tests__/authorize.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
authorize route tests cover success and redirect error iss; not L4 claimed here |
| Form post response mode | OAuth 2.0 Form Post Response Mode | implemented | L1/L2 | apps/server/worker/oidc/authorize-respond.ts; apps/server/worker/oidc/authorize.ts; packages/protocol/src/discovery.ts |
apps/server/worker/oidc/__tests__/authorize.test.ts; packages/protocol/src/__tests__/discovery.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
route tests cover form_post HTML response and discovery advertises form_post; not L4 claimed here |
| Token endpoint duplicate parameter rejection | RFC 6749, RFC 9700 | implemented | L1/L2 | apps/server/worker/oidc/token.ts |
apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
token route tests reject duplicate OAuth parameters; not L4 claimed here |
| PAR | RFC 9126 | implemented | L1/L2/L3 | apps/server/worker/oidc/par.ts; apps/server/worker/durable-objects/par-store.ts |
apps/server/worker/oidc/__tests__/par.test.ts; apps/server/worker/durable-objects/par-store.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
local L3 protocol client smoke posts /par and consumes request_uri through /authorize; duplicate OAuth PAR route was removed; not L4 claimed here |
| DPoP | RFC 9449 | implemented | L1/L2/L3 | apps/server/worker/oidc/dpop.ts; packages/protocol/src/dpop.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-grants.ts; apps/server/worker/oidc/userinfo.ts; packages/db/src/schema/oauth.ts |
packages/protocol/src/__tests__/dpop.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/worker/oidc/__tests__/userinfo.test.ts; apps/server/worker/oidc/__tests__/token-security.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
local L3 protocol client smoke exchanges a DPoP-bound code and calls /userinfo with resource proof; not L4 claimed here |
| Resource Indicators | RFC 8707 | implemented | L1/L2 | apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-grants.ts; apps/server/worker/oidc/token-issue.ts; packages/protocol/src/refresh.ts; packages/db/src/schema/oauth.ts |
apps/server/worker/oidc/__tests__/token.test.ts; apps/server/worker/oidc/__tests__/token-security.test.ts; packages/protocol/src/__tests__/refresh.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
token route tests validate resource audiences and preserve resource in refresh families; not L4 claimed here |
| Protected resource metadata | RFC 9728 | implemented | L1/L2 | packages/protocol/src/discovery.ts; apps/server/worker/oidc/protected-resource.ts; apps/server/worker/oidc/index.ts |
packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
/.well-known/oauth-protected-resource publishes XID-hosted resource metadata for the current issuer; not L4 claimed here |
| JWT access token profile | RFC 9068 | implemented | L1/L2 | packages/protocol/src/tokens.ts; packages/backend/src/verify-token.ts; apps/server/worker/oidc/userinfo.ts; apps/server/worker/oauth/introspect.ts |
packages/protocol/src/__tests__/tokens.test.ts; packages/backend/src/__tests__/verify-token.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/worker/oidc/__tests__/userinfo.test.ts; apps/server/worker/oauth/__tests__/introspect.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
access token JWT typ=at+jwt; SDK/resource checks reject non access-token typ; userinfo and introspection route tests verify access token handling; not L4 claimed here |
| JWT issuer audience kid alg allowlist | RFC 8725, JWS/JWK/JWT | implemented | L1/L2 | packages/crypto/src/jwt.ts; packages/protocol/src/tokens.ts; apps/server/worker/oidc/jwks.ts; apps/server/worker/oidc/token-issue.ts |
packages/crypto/src/__tests__/jwt.test.ts; packages/protocol/src/__tests__/jwt.test.ts; packages/protocol/src/__tests__/tokens.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; packages/backend/src/__tests__/verify-token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
JWT verification checks issuer, audience, kid-selected key, and alg match; token route tests verify signed access and ID token claims; not L4 claimed here |
| JWT alg allowlist | RFC 8725, JWS/JWT | implemented | L1 | packages/crypto/src/jwt.ts; packages/protocol/src/tokens.ts; packages/types/src/signing.ts |
packages/crypto/src/__tests__/jwt.test.ts; packages/protocol/src/__tests__/jwt.test.ts; packages/protocol/src/__tests__/tokens.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
JWT verification and signing tests cover accepted algorithms; not L4 claimed here |
| Instance signing keys | JWK/JWS/JWT, XID design | implemented | L1 | packages/crypto/src/signing-key.ts; packages/crypto/src/jwks.ts; apps/server/worker/oidc/jwks.ts |
packages/crypto/src/__tests__/signing-key.test.ts; packages/crypto/src/__tests__/jwks.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts |
/oidc-oauth; /self-hosting |
packages/i18n/locales/**/messages.po |
instance key generation, JWKS publication, and rotation metadata are local evidence only; not L4 claimed here |
| Device flow | RFC 8628 | implemented | L1/L2/L3 | apps/server/worker/oauth/device.ts; apps/server/worker/oidc/token-exchange.ts; apps/server/worker/durable-objects/device-flow-store.ts; apps/server/worker/me-auth/device-activation.ts; apps/server/src/routes/activate/index.tsx; apps/server/tests/smoke/l3-device-flow.test.mjs; apps/server/worker/test-harness/ |
apps/server/worker/oauth/__tests__/device.test.ts; apps/server/worker/durable-objects/device-flow-store.test.ts; apps/server/worker/me-auth/__tests__/device-activation.test.ts; apps/server/tests/smoke/l3-device-flow.test.mjs |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
local device authorization, activation approve, and token poll L3 smoke; console activate route wired; production Device Flow E2E client L4 not claimed |
| Token exchange access token | RFC 8693 | implemented | L1/L2 | apps/server/worker/oidc/token-exchange.ts |
apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
token route tests cover first-party access-token exchange policy; not L4 claimed here |
| Token exchange refresh/id token issuance | RFC 8693 | implemented | L1/L2 | apps/server/worker/oidc/token-exchange.ts; apps/server/worker/oidc/token-issue.ts |
apps/server/worker/oidc/__tests__/token-exchange.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
first-party confidential clients may request refresh_token or id_token via requested_token_type; exchanged id tokens use short TTL and optional act claim; not L4 claimed here |
| DCR | RFC 7591, RFC 7592 | implemented | L1/L2 | apps/server/worker/oauth/register.ts |
apps/server/worker/oauth/__tests__/register.test.ts |
/management-api; /oidc-oauth |
packages/i18n/locales/**/messages.po |
DCR route tests cover client metadata validation, registration access token read/update/delete, and rejected unverified initial access token/software statement; not L4 claimed here |
| OIDC Dynamic Client Registration | OIDC Registration 1.0 | implemented | L1/L2 | apps/server/worker/oauth/register.ts |
apps/server/worker/oauth/__tests__/register.test.ts |
/management-api; /oidc-oauth |
packages/i18n/locales/**/messages.po |
Route tests cover post logout redirect URI metadata, public subject type, ES256 ID token signing metadata, registration access token read/update/delete, and rejection of unsupported OIDC client metadata; not L4 claimed here |
| Introspection | RFC 7662 | implemented | L1/L2 | apps/server/worker/oauth/introspect.ts; packages/db/src/schema/oauth.ts |
apps/server/worker/oauth/__tests__/introspect.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
access token revoke denylist is checked in route tests; not L4 claimed here |
| Revocation | RFC 7009 | implemented | L1/L2 | apps/server/worker/oauth/revoke.ts; packages/db/src/schema/oauth.ts; apps/server/worker/oidc/userinfo.ts |
apps/server/worker/oauth/__tests__/revoke.test.ts; apps/server/worker/oauth/__tests__/introspect.test.ts; apps/server/worker/oidc/__tests__/userinfo.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
refresh family revoke and access-token jti denylist are covered by route tests; not L4 claimed here |
| JAR | RFC 9101 | implemented | L1/L2 | apps/server/worker/oidc/request-object.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/par.ts; packages/protocol/src/discovery.ts |
apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/par.test.ts; packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
discovery advertises request; authorize and PAR tests validate signed by-value request objects against registered client JWKS with iss, aud, exp, nbf, jti, client_id binding, and jti replay rejection; JWE and remote request object fetch are not claimed |
| JARM | OpenID JARM | implemented | L1/L2 | apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/authorize-respond.ts; apps/server/worker/me-auth/consent.ts; packages/protocol/src/discovery.ts |
apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/me-auth/__tests__/consent.test.ts; packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
discovery advertises query.jwt and fragment.jwt; authorize and consent continuation tests verify signed response JWT for success and error responses; JWE and form_post.jwt are not claimed |
| RAR | RFC 9396 | implemented | L1/L2 | apps/server/worker/oidc/authorization-details.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/par.ts; apps/server/worker/me-auth/consent.ts; apps/server/worker/oidc/token-grants.ts; apps/server/worker/oidc/token-issue.ts; apps/server/worker/oauth/introspect.ts; packages/protocol/src/tokens.ts; packages/protocol/src/refresh.ts; packages/db/src/schema/oauth.ts |
apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/par.test.ts; apps/server/worker/me-auth/__tests__/consent.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/worker/oauth/__tests__/introspect.test.ts; packages/protocol/src/__tests__/tokens.test.ts; packages/protocol/src/__tests__/refresh.test.ts; packages/protocol/src/__tests__/discovery.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
supports AS-controlled resource_access only; validates registered resource audiences and actions, stores grant details, shows consent details, emits access token and introspection authorization_details, advertises supported type, and rejects unknown types/fields; not L4 claimed here |
| mTLS | RFC 8705 | implemented | L1/L2 | apps/server/worker/oidc/mtls.ts; packages/protocol/src/discovery.ts; apps/server/worker/oauth/register.ts; apps/server/worker/oauth/lib/client-auth.ts; apps/server/worker/oidc/client-auth.ts; apps/server/worker/oidc/token-issue.ts |
apps/server/worker/oidc/__tests__/mtls.test.ts; packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts; apps/server/worker/oauth/__tests__/register.test.ts; apps/server/worker/oauth/__tests__/client-auth.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
discovery advertises tls_client_auth methods; DCR accepts subject DN metadata; token endpoint binds access tokens with cnf.x5t#S256 from presented client certificate; tests mock Cloudflare TLS metadata; not L4 claimed here |
| Assertion grants | RFC 7521, RFC 7522, RFC 7523 | guarded-disabled | L1 | apps/server/worker/oidc/token.ts; apps/server/worker/oauth/register.ts |
apps/server/worker/oauth/__tests__/register.test.ts; apps/server/worker/oidc/__tests__/token-security.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth; /management-api |
packages/i18n/locales/**/messages.po |
assertion grant metadata is rejected and no assertion token handler route exists; public docs state JWT bearer and SAML bearer assertion grants are not enabled until a trust root is implemented |
| Implicit and password grant | RFC 9700, OAuth 2.1 draft | deprecated-rejected | L1 | packages/protocol/src/authorize.ts; apps/server/worker/oidc/token.ts |
packages/protocol/src/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
implicit and password grants are rejected and public docs must not claim support |
| Browser-Based Apps draft | draft-ietf-oauth-browser-based-apps-26 | implemented | L1/L2 | packages/protocol/src/authorize.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token.ts; apps/server/worker/oauth/register.ts; apps/server/worker/lib/session.ts; apps/server/worker/oidc/token-grants.ts; packages/protocol/src/discovery.ts |
packages/protocol/src/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/worker/oidc/__tests__/bba.test.ts; apps/server/worker/oauth/__tests__/register.test.ts; apps/server/worker/lib/__tests__/cookies.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth; /hosted-auth |
not applicable until public support claim exists | code flow with PKCE, public client none plus PKCE, implicit/password rejection, registered redirect-origin token CORS, public refresh requires DPoP, discovery advertises browser_based_apps_profile_supported; not L4 claimed here |
| FAPI 2.0 profile | OpenID FAPI 2.0 Security Profile, OpenID FAPI 2.0 Message Signing | implemented | L1/L2 | apps/server/worker/oidc/client-policy.ts; apps/server/worker/oidc/par.ts; apps/server/worker/oidc/dpop.ts; apps/server/worker/oidc/mtls.ts; apps/server/worker/oauth/register.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token.ts; packages/protocol/src/discovery.ts |
apps/server/worker/oidc/__tests__/fapi.test.ts; apps/server/worker/oidc/__tests__/par.test.ts; apps/server/worker/oidc/__tests__/token-security.test.ts; apps/server/worker/oauth/__tests__/register.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; packages/protocol/src/__tests__/discovery.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth |
not applicable until public support claim exists | clients with fapi_profile require PAR and PKCE at authorize and DPoP or mTLS sender-constraint at token; discovery advertises fapi_profile_supported; production FAPI conformance not L4 claimed |
| OIDC ID token | OIDC Core 1.0 | implemented | L1/L2 | apps/server/worker/oidc/token-issue.ts; packages/protocol/src/tokens.ts |
apps/server/worker/oidc/__tests__/token.test.ts; packages/protocol/src/__tests__/tokens.test.ts |
/oidc-oauth; /hosted-auth |
packages/i18n/locales/**/messages.po |
token route tests verify id_token issue and claims; not L4 claimed here |
| OIDC userinfo | OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/oidc/userinfo.ts |
apps/server/worker/oidc/__tests__/userinfo.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
local L3 protocol client smoke verifies DPoP /userinfo claims from a live access token; not L4 claimed here |
| RP-initiated logout | OIDC RP-Initiated Logout | implemented | L1/L2 | apps/server/worker/oidc/end-session.ts |
apps/server/worker/oidc/__tests__/end-session.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
end-session route tests cover RP-initiated logout behavior; not L4 claimed here |
| OIDC ACR/AMR/auth_time and max_age | OIDC Core 1.0, RFC 8176 | implemented | L1/L2 | apps/server/worker/lib/auth-context.ts; apps/server/worker/lib/session.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-grants.ts; apps/server/worker/oidc/token-issue.ts; packages/protocol/src/authorize.ts; packages/protocol/src/refresh.ts |
apps/server/worker/lib/__tests__/session.test.ts; apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; packages/protocol/src/__tests__/authorize.test.ts; packages/protocol/src/__tests__/refresh.test.ts |
public docs must not claim L4 | packages/i18n/locales/**/messages.po |
route tests verify ACR/AMR/auth_time persistence and token emission; protocol tests cover max_age reauthentication decision; not L4 claimed here |
| NIST AAL1 | NIST SP 800-63-4 | implemented | L1/L2 | apps/server/worker/lib/auth-context.ts; apps/server/worker/lib/session.ts; apps/server/worker/oidc/token-issue.ts |
apps/server/worker/lib/__tests__/auth-context.test.ts; apps/server/worker/lib/__tests__/session.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/hosted-auth; /oidc-oauth |
packages/i18n/locales/**/messages.po |
AAL1 auth context is emitted by local session and token tests; not L4 claimed here |
| NIST AAL2 | NIST SP 800-63-4 | implemented | L1/L2 | apps/server/worker/lib/auth-context.ts; apps/server/worker/lib/session.ts; apps/server/worker/me-auth/mfa-challenge.ts; apps/server/worker/me-auth/passkey-signin.ts; apps/server/worker/oidc/token-issue.ts |
apps/server/worker/lib/__tests__/auth-context.test.ts; apps/server/worker/lib/__tests__/session.test.ts; apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts; apps/server/worker/me-auth/__tests__/passkey-signin.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/hosted-auth; /oidc-oauth |
packages/i18n/locales/**/messages.po |
MFA and passkey local route tests emit AAL2 context; not L4 claimed here |
| ACR URIs | OIDC Core 1.0, NIST SP 800-63-4 | implemented | L1/L2 | apps/server/worker/lib/auth-context.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-issue.ts |
apps/server/worker/lib/__tests__/auth-context.test.ts; apps/server/worker/lib/__tests__/session.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token-issue.test.ts |
/oidc-oauth; /hosted-auth |
packages/i18n/locales/**/messages.po |
issued private ACR values are urn:xid:aal1 and urn:xid:aal2; AAL3 requests are explicitly rejected and legacy AAL3 state is normalized before re-issuance |
| AMR vocabulary | OIDC Core 1.0, RFC 8176 | implemented | L1/L2 | packages/types/src/claims.ts; apps/server/worker/lib/auth-context.ts; apps/server/worker/oidc/token-issue.ts |
apps/server/worker/lib/__tests__/auth-context.test.ts; apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts; apps/server/worker/oidc/__tests__/token.test.ts |
/oidc-oauth; /hosted-auth |
packages/i18n/locales/**/messages.po |
private AMR values are emitted in local session and token tests; not L4 claimed here |
| OIDC hybrid response type | OIDC Core 1.0 | implemented | L1/L2 | apps/server/worker/oidc/authorize.ts; apps/server/worker/oauth/register.ts; packages/protocol/src/tokens.ts; packages/protocol/src/discovery.ts |
apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oauth/__tests__/register.test.ts; packages/protocol/src/__tests__/authorize.test.ts; packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
discovery and DCR support code id_token; authorize route tests verify fragment response, signed front-channel id_token, nonce, c_hash, and no at_hash; not L4 claimed here |
| OIDC front-channel logout profile | OIDC Front-Channel Logout | implemented | L1/L2 | packages/protocol/src/discovery.ts; apps/server/worker/oauth/register.ts; apps/server/worker/oidc/end-session.ts |
packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts; apps/server/worker/oauth/__tests__/register.test.ts; apps/server/worker/oidc/__tests__/end-session.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
discovery advertises frontchannel_logout_supported; DCR accepts frontchannel_logout_uri; end_session renders hidden iframe logout HTML when client registered a front-channel URI; not L4 claimed here |
| OIDC back-channel logout profile | OIDC Back-Channel Logout | implemented | L1/L2 | packages/protocol/src/discovery.ts; apps/server/worker/oauth/register.ts; apps/server/worker/oidc/end-session.ts |
packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts; apps/server/worker/oauth/__tests__/register.test.ts; apps/server/worker/oidc/__tests__/end-session.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
discovery advertises OP support and backchannel_logout_session_supported=true; DCR persists HTTPS no-fragment backchannel_logout_uri plus backchannel_logout_session_required across create, read, and update; end_session sends signed logout+jwt form POST with sub/sid always present; not L4 claimed here |
| OIDC Session Management | OIDC Session Management | implemented | L1/L2 | packages/protocol/src/discovery.ts; apps/server/worker/oidc/check-session.ts; apps/server/worker/oidc/index.ts |
packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/check-session.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
discovery advertises check_session_iframe; check_session returns OP iframe HTML that postMessages changed or unchanged based on browser session cookie; not L4 claimed here |
| OIDC CIBA | OIDC CIBA Core | implemented | L1/L2 | packages/protocol/src/discovery.ts; apps/server/worker/oidc/ciba.ts; apps/server/worker/durable-objects/ciba-store.ts; apps/server/worker/oidc/token.ts |
packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/ciba.test.ts; apps/server/worker/durable-objects/__tests__/ciba-store.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
discovery advertises backchannel_authentication_endpoint; each 256-bit CSPRNG base64url auth_req_id uses a CibaStore Durable Object; approved redemption uses a fenced, expiring issuing reservation, finalizes consumed only after signing and optional refresh persistence complete, and rolls back plus aborts on failure; an active owner maps to recoverable authorization_pending, while finalize is fencing-token-idempotent, retried once, and terminal state-confirmed after ambiguous responses; tests cover auth_req_id entropy/encoding, one concurrent owner, stale-owner fencing, post-reservation signing failure, D1 refresh failure followed by retry, and finalize response loss after commit; not L4 claimed here |
| OpenID Federation | OpenID Federation 1.0 | implemented | L1/L2 | packages/protocol/src/discovery.ts; apps/server/worker/oidc/federation.ts; apps/server/worker/oidc/index.ts |
packages/protocol/src/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/discovery.test.ts; apps/server/worker/oidc/__tests__/federation.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
Minimal entity metadata and registration boundary only. Trust-chain resolution, trust anchors, authority-hint traversal, policy processing, and production federation interoperability are not implemented. |
| Shared Signals, CAEP, RISC | OpenID Shared Signals Framework 1.0, OpenID CAEP 1.0, OpenID RISC 1.0 | planned | L1 | apps/server/worker/oidc/ssf.ts |
apps/server/worker/oidc/__tests__/ssf.test.ts; apps/site/src/lib/docs-registry.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
All current endpoints return explicit 501 and do not create streams or claim event delivery. Full transmitter support requires a durable outbox and L4 evidence. |
| GNAP, UMA, HEART, OID4VP, OID4VCI | GNAP, OpenID UMA 2.0, OpenID HEART, OpenID4VP 1.0, OpenID4VCI 1.0 | planned | L1 | apps/server/worker/oidc/optional-protocols.ts; apps/server/worker/oidc/index.ts |
apps/server/worker/oidc/__tests__/optional-protocols.test.ts; apps/site/src/lib/docs-registry.test.ts |
public docs must state unsupported | not applicable | Negative local evidence only. Reserved discovery and route stubs return 501 unsupported_feature; they are not protocol implementations and no functional support is claimed. |
| SAML metadata | SAML 2.0 Metadata | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/saml-views.ts; packages/saml/src/metadata.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
apps/server/worker/sso/__tests__/saml-acs.test.ts; packages/saml/src/__tests__/verify.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| SP metadata | SAML 2.0 Metadata | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/saml-views.ts; packages/saml/src/metadata.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
apps/server/worker/sso/__tests__/saml-acs.test.ts; packages/saml/src/__tests__/verify.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| SP-initiated login | SAML 2.0 Web Browser SSO | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/saml-views.ts; packages/saml/src/authn-request.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
apps/server/worker/sso/__tests__/saml-acs.test.ts; packages/saml/src/__tests__/verify.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| SAML ACS | SAML 2.0 Web Browser SSO | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; packages/saml; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| InResponseTo and replay | SAML Profiles | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/saml-do.ts; packages/saml/src/semantics.ts; packages/saml/src/verify.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
apps/server/worker/sso/__tests__/saml-acs.test.ts; packages/saml/src/__tests__/verify.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| RelayState guard | SAML Bindings | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/saml-views.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
apps/server/worker/sso/__tests__/saml-router.test.ts; apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| XML signature validation | SAML Core, XMLDSig | implemented | L1/L2/L3 | packages/saml/src/verify.ts; packages/saml/src/structure.ts; packages/saml/src/engine.ts; apps/server/worker/sso/saml.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
packages/saml/src/__tests__/verify.test.ts; packages/saml/src/__tests__/spike.test.ts; apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| SAML Destination and bearer SubjectConfirmation | SAML Core, SAML Profiles | implemented | L1/L2/L3 | packages/saml/src/semantics.ts; apps/server/worker/sso/saml.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
packages/saml/src/__tests__/verify.test.ts; apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| SAML EncryptedAssertion | SAML Core, XML Encryption | implemented | L1/L2/L3 | packages/saml/src/decrypt.ts; packages/saml/src/verify.ts; apps/server/worker/sso/saml.ts; apps/server/worker/sso/saml-connection.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
packages/saml/src/__tests__/verify.test.ts; apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks wired; real IdP metadata config L4 not claimed |
| SAML XML security precheck and signature structure whitelist | SAML Core, XMLDSig | implemented | L1/L2/L3 | packages/saml/src/precheck.ts; packages/saml/src/structure.ts; packages/saml/src/schema.ts; packages/saml/src/verify.ts; apps/server/worker/sso/provider-presets.ts; apps/server/worker/test-harness/fake-idp.ts; apps/console/src/routes/org/OrgSso.tsx |
packages/saml/src/__tests__/verify.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
parseSecureXml rejects DTD and entities; the hard-coded recursive SAML Response and Assertion grammar runs before signature verification and again after decryption, while a separate allowlist validates signature/reference structure. This is a closed grammar gate for the consumed profile, not a general XSD engine. Fake IdP inbound SAML L3 covers SP metadata publication; console inbound preset wizard and runbooks are wired; real IdP metadata config and production L4 are not claimed |
| Outbound SAML IdP metadata | SAML 2.0 Metadata | implemented | L1/L2/L3 | packages/saml/src/idp.ts; apps/server/worker/sso/outbound-saml.ts; apps/server/worker/sso/signing-certificate.ts; packages/db/src/schema/sso.ts |
packages/saml/src/__tests__/verify.test.ts; apps/server/worker/sso/__tests__/outbound-saml.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
local app creation reuses or provisions an envelope-encrypted tenant cert_store certificate with usage saml_idp_signing; runtime accepts valid active or retiring certificates while automatic selection uses active. Fake SaaS SP L3 covers IdP metadata with entityID, SSO URL, signing certificate, and NameIDFormat; real SaaS certificate trust, rollover, and admin L4 are not claimed |
| Outbound SAML IdP SSO endpoint | SAML 2.0 Web Browser SSO | implemented | L1/L2/L3 | packages/saml/src/authn-request.ts; packages/saml/src/schema.ts; packages/saml/src/idp.ts; apps/server/worker/sso/outbound-saml.ts; packages/db/src/schema/sso.ts |
packages/saml/src/__tests__/authn-request.test.ts; apps/server/worker/sso/__tests__/outbound-saml.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
binding-specific decoding and a closed AuthnRequest grammar run before exact registered-SP Issuer, Destination, HTTP-POST binding, and ACS checks. Metadata advertises unsigned requests as accepted; supplied embedded or Redirect signatures must verify. Local fake SaaS SP L3 sends a real SP-initiated request, proves a mismatched issuer is rejected, and then covers InResponseTo, signed SAML Response, ACS POST, RelayState, NameID, email attribute, user session gate, and org membership gate; real SaaS L4 is not claimed here |
| Slack downstream SAML template | Slack custom SAML SSO | implemented | L3 | packages/saml/src/idp.ts; apps/server/worker/sso/outbound-saml.ts; docs/protocols/provider-compatibility.md; apps/server/worker/sso/provider-presets.ts; apps/console/src/routes/org/OrgOutboundSso.tsx; docs/protocols/runbooks/slack-downstream-saml.md |
apps/server/tests/smoke/l3-protocol-client.test.mjs; apps/server/worker/sso/__tests__/provider-presets.test.ts |
/enterprise-sso; /saml boundary text |
packages/i18n/locales/**/messages.po |
Slack preset console wizard, outbound SAML API, and fake SaaS SP L3; real Slack admin L4 not claimed |
| GitHub Enterprise downstream SAML template | GitHub Enterprise SAML SSO | implemented | L3 | packages/saml/src/idp.ts; apps/server/worker/sso/outbound-saml.ts; docs/protocols/provider-compatibility.md; apps/console/src/routes/org/OrgOutboundSso.tsx; docs/protocols/runbooks/github-enterprise-downstream-saml.md |
apps/server/tests/smoke/l3-protocol-client.test.mjs |
/enterprise-sso; /saml boundary text |
packages/i18n/locales/**/messages.po |
GitHub Enterprise preset console wizard and fake SaaS SP L3; real GitHub Enterprise admin L4 not claimed |
| Downstream OIDC app catalog | OIDC Core, OIDC Discovery | implemented | L1/L2/L3 | packages/protocol/src/discovery.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token.ts; apps/server/worker/oidc/userinfo.ts; docs/protocols/oidc.md; docs/protocols/provider-compatibility.md |
apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/enterprise-sso; /oidc-oauth boundary text |
packages/i18n/locales/**/messages.po |
generic OIDC/OAuth IdP baseline with fake SaaS OIDC RP callback L3; outbound SAML console wizard is separate and does not register downstream OIDC clients; real SaaS L4 not claimed |
| GitHub Enterprise Managed Users OIDC boundary | GitHub Enterprise Managed Users | implemented | L1/L2 | apps/server/worker/auth/social-providers.ts; apps/console/src/routes/org/OrgSocialProviders.tsx; docs/protocols/provider-compatibility.md; docs/protocols/oidc.md |
apps/server/worker/auth/__tests__/social-providers.test.ts; tests/protocols/source-map-coverage.test.mjs |
/oidc-oauth boundary text |
packages/i18n/locales/**/messages.po |
github_emu social provider preset enforces EMU issuer boundaries (including https://token.actions.githubusercontent.com and Entra tenant issuers), maps external_id to users.external_id, and exposes org console configuration; upstream Social OAuth RP only, not downstream OIDC IdP for GitHub; real GitHub EMU admin L4 missing |
| Microsoft custom enterprise app downstream SSO | Microsoft Entra enterprise app SAML/OIDC | implemented | L1/L2/L3 | packages/saml/src/idp.ts; apps/server/worker/sso/outbound-saml.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token.ts; docs/protocols/provider-compatibility.md; apps/console/src/routes/org/OrgOutboundSso.tsx; docs/protocols/runbooks/microsoft-enterprise-app-downstream.md |
packages/saml/src/__tests__/verify.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/enterprise-sso; /saml boundary text |
packages/i18n/locales/**/messages.po |
Microsoft enterprise app preset wizard and fake SaaS SAML/OIDC L3; real Entra custom app admin L4 not claimed |
| Atlassian downstream SAML template | Atlassian Guard SAML SSO | implemented | L3 | packages/saml/src/idp.ts; apps/server/worker/sso/outbound-saml.ts; docs/protocols/provider-compatibility.md; apps/console/src/routes/org/OrgOutboundSso.tsx; docs/protocols/runbooks/atlassian-downstream-saml.md |
apps/server/tests/smoke/l3-protocol-client.test.mjs |
/enterprise-sso; /saml boundary text |
packages/i18n/locales/**/messages.po |
Atlassian preset wizard and fake SaaS SP L3; real Atlassian Guard admin L4 not claimed |
| Salesforce downstream SAML/OIDC template | Salesforce SAML Service Provider, Salesforce OIDC relying party | implemented | L1/L2/L3 | packages/saml/src/idp.ts; apps/server/worker/sso/outbound-saml.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token.ts; docs/protocols/provider-compatibility.md; apps/console/src/routes/org/OrgOutboundSso.tsx; docs/protocols/runbooks/salesforce-downstream-saml-oidc.md |
packages/saml/src/__tests__/verify.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/enterprise-sso; /saml boundary text |
packages/i18n/locales/**/messages.po |
Salesforce preset wizard and fake SaaS SAML/OIDC L3; real Salesforce admin L4 not claimed |
| Zoom downstream SAML/OIDC template | Zoom SAML SSO, Zoom OIDC SSO | implemented | L1/L2/L3 | packages/saml/src/idp.ts; apps/server/worker/sso/outbound-saml.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token.ts; docs/protocols/provider-compatibility.md; apps/console/src/routes/org/OrgOutboundSso.tsx; docs/protocols/runbooks/zoom-downstream-saml-oidc.md |
packages/saml/src/__tests__/verify.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/enterprise-sso; /saml boundary text |
packages/i18n/locales/**/messages.po |
Zoom preset wizard and fake SaaS SAML/OIDC L3; real Zoom admin L4 not claimed |
| Outbound SAML SLO | SAML 2.0 SLO | implemented | L1/L2 | apps/server/worker/me-auth/signout.ts; apps/server/worker/sso/outbound-saml.ts; apps/server/worker/sso/saml-do.ts; packages/core/src/saml-logout.ts; packages/saml/src/logout.ts; packages/saml/src/idp.ts; docs/design/04-enterprise-sso.md |
apps/server/worker/me-auth/__tests__/signout.test.ts; apps/server/worker/sso/__tests__/outbound-saml.test.ts; packages/core/src/__tests__/saml-logout.test.ts; packages/saml/src/__tests__/logout.test.ts; tests/protocols/source-map-coverage.test.mjs |
/saml |
packages/i18n/locales/**/messages.po |
outbound IdP metadata publishes SingleLogoutService. Local sign-out revokes the XID session before returning a browser HTTP-Redirect or HTTP-POST action; no server-side SP fetch occurs. ChallengeStore keeps one-time request context, signed successful LogoutResponse callbacks consume InResponseTo, enforce exact RelayState and replay rejection, then advance remaining SP actions or redirect to issuer-origin /sign-in. Slack does not support Single Logout and must not be claimed production-supported; real SaaS SLO callback L4 remains missing |
| SAML JIT | SAML 2.0, product policy | implemented | L1/L2/L3 | apps/server/worker/sso/saml-jit.ts; apps/server/worker/sso/saml.ts; apps/server/worker/test-harness/fake-idp.ts |
apps/server/worker/sso/__tests__/saml-jit.test.ts; apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
inbound fake IdP ACS L3 issues session after JIT policy; real IdP config L4 not claimed |
| OIDC enterprise JIT | OIDC Core 1.0, product policy | implemented | L1/L2/L3 | apps/server/worker/sso/oidc-rp.ts; apps/server/worker/sso/jit.ts |
apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/sso/__tests__/jit.test.ts |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
OIDC upstream JIT policy with route tests; real IdP discovery callback L4 not claimed |
| Okta provider compatibility | Okta SAML/OIDC/SCIM behavior, SAML 2.0, OIDC Core 1.0, RFC 7644 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts; apps/server/worker/scim/shared.ts; docs/protocols/runbooks/okta.md; apps/console/src/routes/org/OrgSso.tsx |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/scim/__tests__/scim.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml; /scim |
packages/i18n/locales/**/messages.po |
Okta inbound preset, runbook, and fake IdP L3; real Okta admin L4 not claimed |
| Microsoft Entra ID provider compatibility | Microsoft Entra ID SAML/OIDC/SCIM behavior, SAML 2.0, OIDC Core 1.0, RFC 7644 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts; apps/server/worker/scim/shared.ts; docs/protocols/runbooks/microsoft-entra-id.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/scim/__tests__/scim.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml; /scim |
packages/i18n/locales/**/messages.po |
Entra inbound preset, runbook, and fake IdP L3; real Entra admin L4 not claimed |
| Google Workspace provider compatibility | Google Workspace OIDC/SAML/SCIM behavior, SAML 2.0, OIDC Core 1.0, RFC 7644 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts; docs/protocols/runbooks/google-workspace.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/scim/__tests__/scim.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml; /scim |
packages/i18n/locales/**/messages.po |
Google Workspace inbound preset and runbook with fake IdP L3; real admin L4 not claimed |
| OneLogin provider compatibility | OneLogin SAML/SCIM behavior, SAML 2.0, RFC 7644 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/scim/groups.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/shared.ts; docs/protocols/runbooks/onelogin.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/scim/__tests__/scim.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml; /scim |
packages/i18n/locales/**/messages.po |
OneLogin inbound preset and runbook with fake IdP L3; real admin L4 not claimed |
| JumpCloud provider compatibility | JumpCloud SAML/SCIM behavior, SAML 2.0, RFC 7644 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts; apps/server/worker/scim/shared.ts; docs/protocols/runbooks/jumpcloud.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/scim/__tests__/scim.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml; /scim |
packages/i18n/locales/**/messages.po |
JumpCloud inbound preset and runbook with fake IdP L3; real admin L4 not claimed |
| PingOne provider compatibility | PingOne SAML/OIDC behavior, SAML 2.0, OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/sso/jit.ts; docs/protocols/runbooks/pingone.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/sso/__tests__/jit.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
PingOne inbound preset and runbook with fake IdP L3; real admin L4 not claimed |
| PingFederate provider compatibility | PingFederate SAML/OIDC behavior, SAML 2.0, OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/sso/jit.ts; docs/protocols/runbooks/pingfederate.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/sso/__tests__/jit.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
PingFederate inbound preset and runbook with fake IdP L3; real admin L4 not claimed |
| AD FS provider compatibility | AD FS SAML/OIDC behavior, SAML 2.0, OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/sso/jit.ts; docs/protocols/runbooks/adfs.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/sso/__tests__/jit.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
AD FS inbound preset and runbook with fake IdP L3; real admin L4 not claimed |
| Shibboleth provider compatibility | Shibboleth SAML/OIDC behavior, SAML 2.0, OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/sso/jit.ts; docs/protocols/runbooks/shibboleth.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/sso/__tests__/jit.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
Shibboleth inbound preset and runbook with fake IdP L3; real admin L4 not claimed |
| Keycloak provider compatibility | Keycloak SAML/OIDC behavior, SAML 2.0, OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/sso/saml.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/sso/jit.ts; docs/protocols/runbooks/keycloak.md |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/sso/__tests__/jit.test.ts; apps/server/tests/smoke/l3-inbound-saml.test.mjs |
/enterprise-sso; /saml |
packages/i18n/locales/**/messages.po |
Keycloak inbound preset and runbook with fake IdP L3; real admin L4 not claimed |
| SAML SLO | SAML 2.0 SLO | implemented | L1/L2 | apps/server/worker/sso/saml.ts; packages/saml/src/logout.ts; apps/server/worker/sso/saml-session-bindings.ts |
apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/sso/__tests__/saml-session-bindings.test.ts; packages/saml/src/__tests__/logout.test.ts |
/saml |
packages/i18n/locales/**/messages.po |
GET/POST /sso/saml/:connection/slo verifies signed LogoutRequest (embedded or HTTP-Redirect detached sig), maps SessionIndex/NameID to session revocation via D1 bindings, returns signed LogoutResponse; SP metadata publishes SingleLogoutService; real IdP SLO callback L4 missing |
| LDAP direct bind | RFC 4511 style bind via HTTP gateway, XID enterprise legacy design | implemented | L1/L2/L3 | apps/server/worker/sso/ldap.ts; apps/server/worker/sso/legacy-shared.ts; apps/server/worker/test-harness/fake-ldap.ts |
apps/server/worker/sso/__tests__/legacy-enterprise.test.ts; apps/server/tests/smoke/l3-inbound-legacy.test.mjs |
/enterprise-sso |
packages/i18n/locales/**/messages.po |
POST /sso/ldap/:connectionId/login binds through fake LDAP harness in development/test or configured HTTP LDAP gateway; native LDAP sockets are not used in Workers; real AD/LDAP gateway L4 missing |
| WS-Federation | WS-Federation Passive Requester, Microsoft AD FS WS-Fed | implemented | L1/L2/L3 | apps/server/worker/sso/wsfed.ts; apps/server/worker/sso/legacy-shared.ts; apps/server/worker/test-harness/fake-wsfed.ts |
apps/server/worker/sso/__tests__/legacy-enterprise.test.ts; apps/server/tests/smoke/l3-inbound-legacy.test.mjs |
/enterprise-sso |
packages/i18n/locales/**/messages.po |
GET /sso/wsfed/:connectionId/login and callback wresult parsing with fake WS-Fed harness L3; production callbacks require signed wresult validation against configured IdP certificates; real AD FS/Entra metadata L4 missing |
| SWA password vaulting | Okta SWA, Microsoft Entra password-based SSO | implemented | L1/L2/L3 | apps/server/worker/sso/swa.ts; apps/server/worker/sso/legacy-shared.ts; apps/server/worker/test-harness/fake-swa.ts |
apps/server/worker/sso/__tests__/legacy-enterprise.test.ts; apps/server/tests/smoke/l3-inbound-legacy.test.mjs |
/enterprise-sso |
packages/i18n/locales/**/messages.po |
POST /sso/swa/:connectionId/authenticate verifies SHA-256 hashes from envelope-encrypted _swaVaultEnvelope; /vault requires org manager or connections:write API key; fake SWA harness L3; real target app replay and vault rotation L4 missing |
| Header-based SSO | Microsoft Entra header-based SSO, trusted reverse proxy pattern | implemented | L1/L2/L3 | apps/server/worker/sso/directory-connector.ts; apps/server/worker/sso/legacy-shared.ts |
apps/server/worker/sso/__tests__/legacy-enterprise.test.ts; apps/server/tests/smoke/l3-inbound-legacy.test.mjs |
/enterprise-sso |
packages/i18n/locales/**/messages.po |
POST /sso/header/:connectionId/authenticate maps trusted X-Remote-User / X-Remote-Email headers and requires X-Trusted-Proxy-Secret plus attribute_mapping._legacy.trustedProxySecret on create; real Application Proxy or header injection L4 missing |
| Directory connector framework | Microsoft Entra provisioning connectors overview, XID enterprise legacy design | implemented | L1/L2 | apps/server/worker/sso/directory-connector.ts |
apps/server/worker/sso/__tests__/legacy-enterprise.test.ts |
/enterprise-sso |
packages/i18n/locales/**/messages.po |
GET /sso/directory-connectors/types and POST /sso/directory-connectors/:connectionId/validate expose connector registry; LDAP/header connectors implemented, SQL/REST/SOAP/PowerShell/ECMA remain stub; non-SCIM provisioning L4 missing |
| Kerberos deployment pattern | Microsoft Entra plan SSO deployment, XID enterprise legacy design | implemented | L1 | docs/design/04-enterprise-sso.md |
apps/server/worker/sso/__tests__/legacy-enterprise.test.ts; tests/protocols/source-map-coverage.test.mjs |
/enterprise-sso |
not applicable | Kerberos/IWA deployment pattern documented in design docs; XID does not terminate Kerberos or SPNEGO in Workers; real KDC/proxy L4 missing |
| SCIM ServiceProviderConfig | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/index.ts |
apps/server/worker/scim/__tests__/scim.test.ts |
/scim |
packages/i18n/locales/**/messages.po |
SCIM route tests cover ServiceProviderConfig capabilities; not L4 claimed here |
| Directory bearer token | RFC 6750 style bearer usage, RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/shared.ts; apps/server/worker/v1/directories.ts |
apps/server/worker/scim/__tests__/scim.test.ts; apps/server/worker/v1/__tests__/isolation.test.ts |
/scim; /management-api |
packages/i18n/locales/**/messages.po |
directory bearer token hash and rotation grace are local route evidence only; this is not an OAuth-issued access token and not L4 claimed here |
| Downstream SaaS SCIM target clients | RFC 7643, RFC 7644 | implemented | L2/L3 | apps/server/worker/scim/outbound.ts; apps/server/worker/scim/target-credentials.ts; packages/db/src/schema/directory.ts; packages/db/drizzle/0000_init.sql; docs/protocols/scim.md; docs/protocols/provider-compatibility.md |
apps/server/tests/smoke/l3-protocol-client.test.mjs; apps/server/worker/scim/__tests__/target-credentials.test.ts |
/scim boundary text |
packages/i18n/locales/**/messages.po |
local fake SaaS SCIM target L3 covers outbound SCIM target config, server-derived target-specific secret lookup, public-HTTPS target validation, Users push, Groups push, deactivation PATCH, correlated retry and audit; real Slack/GitHub Enterprise Cloud/Atlassian/Salesforce/Zoom admin L4, SaaS-specific endpoint templates, and production support are missing; inbound SCIM Service Provider evidence cannot be reused as SCIM push-to-SaaS L4 |
| SCIM Schemas and ResourceTypes | RFC 7643 | implemented | L1/L2 | apps/server/worker/scim/index.ts |
apps/server/worker/scim/__tests__/scim.test.ts |
/scim |
packages/i18n/locales/**/messages.po |
SCIM route tests cover Schemas and ResourceTypes; not L4 claimed here |
| SCIM Users | RFC 7643, RFC 7644 | implemented | L1/L2/L3 | apps/server/worker/scim/users.ts |
apps/server/worker/scim/__tests__/scim.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/scim |
packages/i18n/locales/**/messages.po |
local L3 protocol client smoke covers Users create/list/PATCH against dev server; not L4 claimed here |
| SCIM Groups | RFC 7643, RFC 7644 | implemented | L1/L2/L3 | apps/server/worker/scim/groups.ts |
apps/server/worker/scim/__tests__/scim.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/scim |
packages/i18n/locales/**/messages.po |
local L3 protocol client smoke covers Groups create/delete against dev server; not L4 claimed here |
| ListResponse pagination | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts; apps/server/worker/scim/shared.ts |
apps/server/worker/scim/__tests__/scim.test.ts |
/scim |
packages/i18n/locales/**/messages.po |
startIndex, count, totalResults, and itemsPerPage are local SCIM route evidence only; not L4 claimed here |
| SCIM ETag If-Match | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/shared.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts |
apps/server/worker/scim/__tests__/scim.test.ts; apps/site/src/lib/docs-registry.test.ts |
/scim |
packages/i18n/locales/**/messages.po |
SCIM route tests cover ETag headers, If-Match precondition checks (428/412), and meta.version; not L4 claimed here |
| SCIM simple filters and invalidFilter guard | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/shared.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts |
apps/server/worker/scim/__tests__/scim.test.ts |
/scim |
packages/i18n/locales/**/messages.po |
SCIM route tests cover simple filters and invalidFilter errors; not L4 claimed here |
| SCIM full filter grammar | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/shared.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts |
apps/server/worker/scim/__tests__/scim.test.ts |
/scim |
packages/i18n/locales/**/messages.po |
SCIM route tests cover AND/OR/NOT and comparison operators; unsupported expressions return 400 invalidFilter; not L4 claimed here |
| SCIM attributes projection | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/shared.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts |
apps/server/worker/scim/__tests__/scim.test.ts |
/scim |
packages/i18n/locales/**/messages.po |
SCIM route tests cover attributes and excludedAttributes; not L4 claimed here |
| SCIM PATCH and error model | RFC 7644 | implemented | L1/L2/L3 | apps/server/worker/scim/shared.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts |
apps/server/worker/scim/__tests__/scim.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/scim |
packages/i18n/locales/**/messages.po |
local L3 protocol client smoke covers SCIM User PATCH against dev server; SCIM error model remains L1/L2; not L4 claimed here |
| PATCH | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/shared.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts |
apps/server/worker/scim/__tests__/scim.test.ts |
/scim |
packages/i18n/locales/**/messages.po |
local route tests cover add, replace, remove, noTarget, invalidSyntax, and mutability behavior; not L4 claimed here |
| sort | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/shared.ts; apps/server/worker/scim/users.ts; apps/server/worker/scim/groups.ts; apps/server/worker/scim/index.ts |
apps/server/worker/scim/__tests__/scim.test.ts; apps/site/src/lib/docs-registry.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/scim |
packages/i18n/locales/**/messages.po |
SCIM route tests cover sortBy and sortOrder on Users/Groups list; ServiceProviderConfig advertises sort.supported=true; not L4 claimed here |
| bulk | RFC 7644 | implemented | L1/L2 | apps/server/worker/scim/bulk.ts; apps/server/worker/scim/index.ts |
apps/server/worker/scim/__tests__/scim.test.ts; apps/site/src/lib/docs-registry.test.ts; apps/server/tests/smoke/l3-protocol-client.test.mjs |
/scim |
packages/i18n/locales/**/messages.po |
SCIM route tests cover POST /Bulk with operation limits and multi-status BulkResponse; ServiceProviderConfig advertises bulk.supported=true; not L4 claimed here |
| WebAuthn registration | WebAuthn Level 3 | implemented | L1/L2 | packages/webauthn/src/verify-registration.ts; apps/server/worker/auth/passkey.ts |
packages/webauthn/src/__tests__/verify.test.ts; apps/server/worker/auth/__tests__/passkey.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
package tests cover four verification primitives and route tests cover registration options/verify; not L4 claimed here |
| Registration options | WebAuthn Level 3 | implemented | L1/L2 | apps/server/worker/auth/passkey.ts; packages/webauthn/src/authdata.ts; packages/types/src/webauthn.ts |
apps/server/worker/auth/__tests__/passkey.test.ts; packages/webauthn/src/__tests__/verify.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
residentKey and userVerification options are local route evidence only; not L4 claimed here |
| Registration verification | WebAuthn Level 3 | implemented | L1/L2 | packages/webauthn/src/verify-registration.ts; packages/webauthn/src/authdata.ts; apps/server/worker/auth/passkey.ts |
packages/webauthn/src/__tests__/verify.test.ts; apps/server/worker/auth/__tests__/passkey.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
package and route tests cover challenge, origin, rpIdHash, UP, UV, AT, and storage output; not L4 claimed here |
| WebAuthn authentication | WebAuthn Level 3 | implemented | L1/L2 | packages/webauthn/src/verify-authentication.ts; apps/server/worker/me-auth/passkey-signin.ts |
packages/webauthn/src/__tests__/assertion-vectors.test.ts; apps/server/worker/me-auth/__tests__/passkey-signin.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
package tests cover challenge/origin/rpIdHash/signature/signCount and route tests cover passkey sign-in; not L4 claimed here |
| Authentication verification | WebAuthn Level 3 | implemented | L1/L2 | packages/webauthn/src/verify-authentication.ts; packages/webauthn/src/authdata.ts; apps/server/worker/me-auth/passkey-signin.ts |
packages/webauthn/src/__tests__/verify.test.ts; packages/webauthn/src/__tests__/assertion-vectors.test.ts; apps/server/worker/me-auth/__tests__/passkey-signin.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
package and route tests cover challenge, origin, rpIdHash, signature, UP, UV, and signCount; not L4 claimed here |
| WebAuthn malformed input normalization | WebAuthn Level 3 | implemented | L1/L2 | packages/webauthn/src/verify-registration.ts; packages/webauthn/src/verify-authentication.ts; apps/server/worker/auth/passkey.ts; apps/server/worker/me-auth/passkey-signin.ts |
packages/webauthn/src/__tests__/verify.test.ts; apps/server/worker/auth/__tests__/passkey.test.ts; apps/server/worker/me-auth/__tests__/passkey-signin.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
malformed input normalization is covered by package and route tests; not L4 claimed here |
| Discoverable credentials | WebAuthn Level 3 | implemented | L1/L2 | apps/server/worker/auth/passkey.ts; apps/server/worker/me-auth/passkey-signin.ts; packages/types/src/webauthn.ts |
apps/server/worker/auth/__tests__/passkey.test.ts; apps/server/worker/me-auth/__tests__/passkey-signin.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
discoverable credential and Conditional UI route evidence is local only; not L4 claimed here |
| Sign count clone detection | WebAuthn Level 3 | implemented | L1/L2 | packages/webauthn/src/verify-authentication.ts; apps/server/worker/auth/passkey-helpers.ts; apps/server/worker/me-auth/passkey-signin.ts |
packages/webauthn/src/__tests__/verify.test.ts; packages/webauthn/src/__tests__/assertion-vectors.test.ts; apps/server/worker/me-auth/__tests__/passkey-signin.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
signCount anomaly detection and persistence are local test evidence only; not L4 claimed here |
| Backup eligibility/state storage | WebAuthn Level 3 | implemented | L1/L2 | packages/webauthn/src/authdata.ts; packages/webauthn/src/verify-registration.ts; packages/webauthn/src/verify-authentication.ts; apps/server/worker/me/me.ts |
packages/webauthn/src/__tests__/verify.test.ts; apps/server/worker/me/__tests__/me.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
backup eligibility and state are stored and exposed in local tests; not L4 claimed here |
| WebAuthn enterprise attestation | WebAuthn Level 3 | implemented | L1/L2 | apps/server/worker/auth/passkey.ts; packages/webauthn/src/verify-registration.ts; packages/webauthn/src/attestation.ts; apps/console/src/routes/org/OrgAuthPolicy.tsx |
apps/server/worker/auth/__tests__/passkey.test.ts; packages/webauthn/src/__tests__/verify.test.ts; apps/site/src/lib/docs-registry.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
org policy attestationMode drives indirect/direct registration; packed attStmt signature and trusted-root chain verification implemented locally; not L4 claimed here |
| WebAuthn EdDSA COSE alg | WebAuthn Level 3, COSE | implemented | L1/L2 | packages/types/src/webauthn.ts; packages/webauthn/src/cose.ts; packages/webauthn/src/verify-authentication.ts; apps/server/worker/auth/passkey.ts |
packages/webauthn/src/__tests__/verify.test.ts; packages/webauthn/src/__tests__/cose.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
EdDSA(-8) COSE keys parse and verify in registration/authentication paths; registration options advertise ES256/RS256/EdDSA; not L4 claimed here |
| Passkey MFA challenge | WebAuthn Level 3, NIST SP 800-63-4 | implemented | L1/L2 | apps/server/worker/lib/mfa-session.ts; apps/server/worker/me-auth/passkey-mfa-challenge.ts; apps/server/worker/me/mfa-factors.ts; apps/server/worker/me/me.ts; apps/server/src/routes/mfa/index.tsx |
apps/server/worker/lib/__tests__/mfa-session.test.ts; apps/server/worker/me-auth/__tests__/passkey-mfa-challenge.test.ts; apps/server/worker/me/__tests__/mfa-factors.test.ts; apps/server/worker/me/__tests__/me.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
dedicated /auth/mfa/passkey/options + /auth/mfa/passkey/verify with UV required and MFA UI path; excludes primary passkey AMR from challenge requirement; not L4 claimed here |
| Step-up credential | RFC 9470 adjacent, OIDC Core 1.0 | implemented | L1/L2 | apps/server/worker/lib/mfa-session.ts; apps/server/worker/me-auth/mfa-challenge.ts; apps/server/worker/oidc/authorize.ts; apps/server/src/routes/mfa/index.tsx; packages/protocol/src/authorize.ts |
apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/auth/__tests__/mfa.test.ts; packages/protocol/src/__tests__/authorize.test.ts |
/hosted-auth; /oidc-oauth |
packages/i18n/locales/**/messages.po |
acr_values and OIDC claims.id_token.acr requests for urn:xid:aal2 route AAL1 sessions through step-up MFA, bind the short-lived step-up cookie to user and session, and persist AAL2 ACR/AMR on the authorization code; not L4 claimed here |
| NIST AAL3 | NIST SP 800-63-4 | planned | L1/L2 | apps/server/worker/lib/auth-context.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-issue.ts; apps/server/worker/me-auth/passkey-mfa-challenge.ts |
apps/server/worker/lib/__tests__/auth-context.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token-issue.test.ts; apps/server/worker/me-auth/__tests__/passkey-mfa-challenge.test.ts |
/hosted-auth; /oidc-oauth |
packages/i18n/locales/**/messages.po |
negative local evidence only; not supported: WebAuthn UV and BE/BS flags do not prove a non-exportable hardware-protected key; requests return explicit interaction_required, and no AAL3 code or token is issued |
| TOTP MFA | NIST SP 800-63B | implemented | L1/L2 | apps/server/worker/auth/mfa.ts; apps/server/worker/me-auth/mfa-challenge.ts |
apps/server/worker/auth/__tests__/mfa.test.ts; apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
TOTP route tests cover setup, verification, and replay guard; not L4 claimed here |
| Backup codes | NIST recovery guidance | implemented | L1/L2 | apps/server/worker/auth/backup-codes.ts; apps/server/worker/me-auth/mfa-challenge.ts; apps/server/worker/me/mfa-factors.ts |
apps/server/worker/auth/__tests__/backup-codes.test.ts; apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts; apps/server/worker/me/__tests__/mfa-factors.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
backup code generation, listing, and one-time consumption are local route evidence only; not L4 claimed here |
| SMS MFA | NIST SP 800-63B | implemented | L1/L2/L3 | apps/server/worker/me-auth/mfa-challenge.ts; apps/server/worker/queues/sms.ts; apps/server/worker/auth/delivery-channels.ts; apps/server/worker/test-harness/test-otp.ts; apps/console/src/routes/org/OrgDeliveryChannels.tsx |
apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts; apps/server/worker/queues/__tests__/sms.test.ts; apps/server/tests/smoke/l3-delivery-otp.test.mjs |
/hosted-auth |
packages/i18n/locales/**/messages.po |
test SMS provider capture plus MFA SMS route tests; real SMS provider delivery L4 not claimed |
| Passkey as MFA | WebAuthn Level 3, NIST SP 800-63-4 | implemented | L1/L2 | apps/server/worker/lib/mfa-session.ts; apps/server/worker/me-auth/passkey-mfa-challenge.ts; apps/server/worker/me/mfa-factors.ts; apps/server/worker/me/me.ts; apps/server/src/routes/account/MfaSection.tsx |
apps/server/worker/lib/__tests__/mfa-session.test.ts; apps/server/worker/me-auth/__tests__/passkey-mfa-challenge.test.ts; apps/server/worker/me/__tests__/mfa-factors.test.ts; apps/server/worker/me/__tests__/me.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
passkey credentials count toward MFA requirement and challenge; /v1/me/mfa-factors lists passkey factors; password/OTP sessions can complete MFA with passkey; not L4 claimed here |
| AAL/ACR/AMR mapping | OIDC Core 1.0, RFC 8176, NIST SP 800-63-4 | implemented | L1/L2 | apps/server/worker/lib/auth-context.ts; apps/server/worker/me-auth/mfa-challenge.ts; apps/server/worker/oidc/token-issue.ts; packages/protocol/src/tokens.ts |
apps/server/worker/lib/__tests__/auth-context.test.ts; apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; packages/protocol/src/__tests__/tokens.test.ts |
/oidc-oauth; /hosted-auth |
packages/i18n/locales/**/messages.po |
local route and protocol tests emit AAL/ACR/AMR mapping; not L4 claimed here |
| Guest sign-in (anonymous) | XID private extension, not an OIDC/OAuth standard capability | implemented | L1/L2 | apps/server/worker/me-auth/guest.ts; apps/server/worker/me-auth/guest-conversion.ts; apps/server/worker/durable-objects/guest-store.ts; apps/server/worker/crons/daily.ts; apps/server/src/routes/sign-in/useSignIn.ts |
apps/server/worker/me-auth/__tests__/guest.test.ts; apps/server/worker/me-auth/__tests__/guest-conversion.test.ts; apps/server/worker/durable-objects/__tests__/guest-store.test.ts; apps/server/worker/crons/__tests__/guest-gc.test.ts; apps/server/src/routes/sign-in/useSignIn.guest.test.tsx |
internal design chapter docs/design/01-authentication.md section 8 |
packages/i18n/locales/**/messages.po |
POST /auth/guest creates a real user row under the four-layer anti-duplicate contract; Hosted Auth sends the resulting session into top-level Tenant onboarding; conversion in the new Tenant verifies the pending Email in place, preserves sub, revokes all guest sessions, and requires a fresh sign-in; the same Email in another Tenant remains independent; local route and DO tests only, L3 smoke and L4 not claimed |
| Session cookie and /v1/me | OAuth browser security, XID design | implemented | L1/L2 | apps/server/worker/lib/session.ts; apps/server/worker/middleware/session.ts; apps/server/worker/me/me.ts |
apps/server/worker/lib/__tests__/cookies.test.ts; apps/server/worker/lib/__tests__/session.test.ts; apps/server/worker/me/__tests__/me.test.ts |
/hosted-auth; /self-hosting |
packages/i18n/locales/**/messages.po |
session cookie and /v1/me route tests cover active session consistency; not L4 claimed here |
| Session auth context | OIDC Core 1.0, NIST SP 800-63-4 | implemented | L1/L2 | apps/server/worker/lib/auth-context.ts; apps/server/worker/lib/session.ts; packages/db/src/schema/sessions.ts |
apps/server/worker/lib/__tests__/auth-context.test.ts; apps/server/worker/lib/__tests__/session.test.ts; apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts |
/hosted-auth; /oidc-oauth |
packages/i18n/locales/**/messages.po |
session rows persist ACR/AMR/AAL in local tests; not L4 claimed here |
| Pending MFA session | XID design | implemented | L1/L2 | apps/server/worker/lib/mfa-session.ts; apps/server/worker/me-auth/mfa-challenge.ts; apps/server/worker/lib/session.ts |
apps/server/worker/lib/__tests__/mfa-session.test.ts; apps/server/worker/me-auth/__tests__/mfa-challenge.test.ts; apps/server/worker/lib/__tests__/session.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
pending MFA session enforcement is local route evidence only; not L4 claimed here |
| Passwordless continuation integrity | XID Hosted Auth security contract | implemented | L1/L2 | apps/server/worker/auth/passwordless-flow.ts; apps/server/worker/auth/magic-link.ts; apps/server/worker/auth/otp.ts; apps/server/worker/me-auth/passwordless.ts; packages/db/src/schema/credentials.ts; packages/db/drizzle/0010_passwordless_flow_context.sql; packages/db/drizzle/0015_magic_link_tokens.sql; apps/server/src/routes/magic-link/index.tsx |
apps/server/worker/auth/__tests__/passwordless-flow.test.ts; apps/server/worker/auth/__tests__/magic-link.test.ts; apps/server/worker/auth/__tests__/otp.test.ts; apps/server/worker/me-auth/__tests__/passwordless.test.ts; packages/db/src/__tests__/migration-0010.test.ts; packages/db/src/__tests__/migration-0015.test.ts; apps/server/src/routes/magic-link/index.test.tsx |
/hosted-auth |
packages/i18n/locales/**/messages.po |
send freezes versioned intent, normalized server-owned continuation, and application client in magic_link_tokens.flow_context for magic links and verification_tokens.flow_context for OTP; magic-link JWT and row must match byte-for-byte, email links carry the token in a fragment, GET is mutation-free, explicit POST consumes it, multiple unexpired magic links remain independently valid, OTP reads only the persisted context, application authorize continuations are exact client-bound, and verification cannot rewrite the flow. Invitation tokens and row ids are not passwordless context: every invitation uses the separate proof-first Email claim; local route and migration tests only, not L4 claimed |
| Organization invitation accept | XID org onboarding | implemented | L1/L2 | apps/server/worker/auth/invitations.ts; apps/server/worker/auth/invitation-continuation.ts; apps/server/worker/auth/social.ts; apps/server/worker/sso/oidc-rp.ts; apps/server/worker/sso/saml.ts; apps/server/worker/me-auth/invitation-claim-token.ts; apps/server/worker/me-auth/invitation-claim.ts; apps/server/worker/me-auth/invitation-accept.ts; apps/server/worker/auth/hosted-policy.ts; apps/server/worker/lib/invitation-token.ts; apps/server/worker/lib/mfa-session.ts; apps/server/worker/lib/session.ts; apps/server/worker/v1/invitations.ts; packages/db/src/tenant-context.ts; packages/db/src/schema/users.ts; packages/db/src/schema/rbac.ts; packages/db/drizzle/0006_expire_legacy_invitation_tokens.sql; packages/db/drizzle/0011_invitation_email_claim.sql; apps/server/src/routes/accept-invitation/index.tsx; apps/server/worker/queues/email.ts |
apps/server/worker/auth/__tests__/invitations.test.ts; apps/server/worker/auth/__tests__/invitation-atomicity.test.ts; apps/server/worker/auth/__tests__/invitation-continuation.test.ts; apps/server/worker/auth/__tests__/social.test.ts; apps/server/worker/sso/__tests__/oidc-rp.test.ts; apps/server/worker/sso/__tests__/saml-acs.test.ts; apps/server/worker/me-auth/__tests__/invitation-accept.test.ts; apps/server/worker/me-auth/__tests__/invitation-claim.test.ts; apps/server/src/routes/accept-invitation/index.test.tsx; apps/server/scripts/__tests__/migration-0006-expire-legacy-invitations.test.mjs; packages/db/src/__tests__/migration-0011.test.ts |
/hosted-auth |
packages/i18n/locales/**/messages.po |
the raw capability is preview-only and resolves a same-Instance candidate Tenant before the complete hash matches in its scoped DB. Every holder then uses the exact-Email proof-first claim; raw or signed-continuation /auth/invitation/accept is rejected. The signed 15-minute claim binds purpose, Tenant, invitation, jti, and Email hash. Before proof, no User, credential, identity, session, or Membership is selected or written. Send and verify re-resolve the active target Organization and enforce its Email, Magic Link, force-SSO, creation/login, and MFA policy. The first random winner commits pending -> claim_verified, reusing only an exact active claim-proven User/primary Email tuple or detaching only an unsafe colliding Email and creating a credential-free User. The original JWT plus the same browser recovery key recovers a leased session and the separately winner-gated Membership plus claim_verified -> accepted transition; accepted retries do not repeat Membership or webhook effects. Management hides claim internals, prevents duplicate pending claims, and can revoke claim_verified; migration 0011 normalizes and deterministically revokes historical duplicate pending rows before installing the filtered unique index. L2 tests cover hash-only claim delivery, opaque invalid starts, recovery mismatch, accepted retry idempotency, target-policy gating, fail-closed legacy acceptance, Hosted UI fragment/recovery/stale-storage behavior, migration duplicate reconciliation, and federation rejection before provider, state, JIT, or session side effects. The proof-stage collision/reuse SQL and finalization winner branches remain L1 code evidence; local evidence only, not L4 claimed |
| Self-service top-level Tenant onboarding | XID org onboarding | implemented | L1/L2 | apps/server/worker/me-auth/organization-self.ts; apps/server/worker/me-auth/email-verify-token.ts; apps/server/worker/me-auth/email-verification.ts; apps/server/worker/me-auth/password-signin.ts; apps/server/worker/auth/social.ts; apps/server/worker/lib/management-access.ts; apps/server/worker/crons/daily.ts; apps/server/src/routes/create-organization/index.tsx; apps/server/src/routes/sign-in/useSignIn.ts |
apps/server/worker/me-auth/__tests__/organization-self.test.ts; apps/server/worker/me-auth/__tests__/email-verify-token.test.ts; apps/server/worker/me-auth/__tests__/email-verification.test.ts; apps/server/worker/me-auth/__tests__/password-signin.test.ts; apps/server/worker/auth/__tests__/social.test.ts; apps/server/worker/lib/__tests__/management-access.test.ts; apps/server/worker/crons/__tests__/guest-gc.test.ts; apps/server/src/routes/create-organization/index.test.tsx; apps/server/src/routes/sign-in/useSignIn.test.tsx; apps/server/src/routes/verify-email/index.test.tsx |
/hosted-auth |
packages/i18n/locales/**/messages.po |
guest and intent=sign-up flows converge on a provisional-user-only create path; password verification preserves the signed intent and social OAuth carries both intent and create-organization return; onboarding creates id = tenant_id, migrates user-owned rows and sessions, writes owner Membership, and preserves the opaque cookie while the root resolver switches TenantContext by refresh token hash; guest Email remains pending outside user_emails, Console reads stay available while business mutations require verified Email, signed email_hash binds verification to the exact current target, and 30-day GC soft-deletes safe empty onboarding roots while skipping nonempty Tenants; Email uniqueness stays Tenant-local and no cross-Tenant merge occurs; local route tests only, L3 smoke and L4 not claimed |
| OAuth organization context selection | OIDC Core 1.0, XID org context | implemented | L1/L2 | apps/server/worker/oidc/authorize.ts; apps/server/worker/me-auth/active-organization.ts; apps/server/src/routes/select-organization/index.tsx |
apps/server/worker/oidc/__tests__/authorize.test.ts |
/hosted-auth; /oidc-oauth |
packages/i18n/locales/**/messages.po |
multi-org users without activeOrgId are redirected to /select-organization before consent/code when client requires org context or scope includes organization; not L4 claimed here |
| Soft deleted and revoked subject gates | RFC 9700, XID session policy | implemented | L1/L2 | apps/server/worker/lib/session.ts; apps/server/worker/oidc/authorize.ts; apps/server/worker/oidc/token-issue.ts; apps/server/worker/oidc/userinfo.ts; apps/server/worker/me/me.ts; packages/db/src/tenant-context.ts |
apps/server/worker/lib/__tests__/session.test.ts; apps/server/worker/oidc/__tests__/authorize.test.ts; apps/server/worker/oidc/__tests__/token.test.ts; apps/server/worker/oidc/__tests__/userinfo.test.ts; apps/server/worker/me/__tests__/me.test.ts |
/oidc-oauth; /hosted-auth; /self-hosting |
packages/i18n/locales/**/messages.po |
route tests cover soft deleted users, revoked sessions, inactive organizations, revoked grants, and invalid token/session behavior; not L4 claimed here |
| Self-service privacy export and erasure | GDPR data subject access and erasure | implemented | L1/L2 | apps/server/src/routes/account/PrivacySection.tsx; apps/server/worker/me/privacy.ts; apps/server/worker/privacy/export.ts; apps/server/worker/privacy/erasure.ts; apps/server/worker/privacy/erasure-eligibility.ts; apps/server/worker/queues/privacy.ts; apps/server/worker/crons/privacy.ts; apps/server/worker/lib/audit-actor.ts; apps/server/wrangler.jsonc |
apps/server/src/routes/account/PrivacySection.test.tsx; apps/server/worker/me/__tests__/privacy.test.ts; apps/server/worker/privacy/__tests__/erasure-eligibility.test.ts; apps/server/worker/queues/__tests__/privacy.test.ts; apps/server/worker/crons/__tests__/privacy.test.ts; apps/server/worker/lib/__tests__/audit-actor.test.ts; apps/server/scripts/__tests__/queue-dlq-config.test.mjs |
/self-hosting |
packages/i18n/locales/**/messages.po |
cookie-scoped create/list/get/cancel/download; UI second confirmation plus exact API deletion confirmation; private R2 JSON export with explicit secret-free projections and 48-hour expiry; cancelable 30-day erasure; scheduling and execution both protect every sole active Organization owner and the last active platform instance_manager in the same Instance scope, with an atomic D1 batch guard for grace-period role changes; own and impersonation SessionDO plus OAuth revocation; accepted-invitation Email pseudonymization; minimal erased user tombstone; immutable audit history renders [deleted_user] and receives an appended completion event. Local SPA/Worker/Queue tests only; production Queue, R2, Cron, and L4 behavior are not claimed |
| Access token revocation denylist | RFC 7009 | implemented | L1/L2 | packages/db/src/schema/oauth.ts; apps/server/worker/oauth/revoke.ts; apps/server/worker/oauth/introspect.ts; apps/server/worker/oidc/userinfo.ts |
apps/server/worker/oauth/__tests__/revoke.test.ts; apps/server/worker/oauth/__tests__/introspect.test.ts; apps/server/worker/oidc/__tests__/userinfo.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
access token jti denylist is enforced in local route tests; not L4 claimed here |
| Access token tenant binding | XID design, RFC 7662, RFC 6750 | implemented | L1/L2 | packages/protocol/src/tokens.ts; packages/types/src/claims.ts; apps/server/worker/oauth/introspect.ts; apps/server/worker/oidc/userinfo.ts |
packages/protocol/src/__tests__/tokens.test.ts; apps/server/worker/oauth/__tests__/introspect.test.ts; apps/server/worker/oidc/__tests__/userinfo.test.ts |
/oidc-oauth |
packages/i18n/locales/**/messages.po |
access token tenant_id claim binding is enforced in local protocol and route tests; introspect returns active:false and userinfo returns 401 invalid_token on tenant mismatch; not L4 claimed here |
| Apple social OAuth provider | OAuth 2.0 Form Post Response Mode, OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/auth/social.ts; apps/server/worker/auth/social-providers.ts; apps/console/src/routes/org/OrgSocialProviders.tsx; apps/server/worker/test-harness/fake-social.ts |
apps/server/worker/auth/__tests__/social.test.ts; apps/server/worker/auth/__tests__/social-providers.test.ts; apps/server/tests/smoke/l3-social-oauth.test.mjs |
/social-login; /hosted-auth |
packages/i18n/locales/**/messages.po |
fake Apple social OAuth L3 uses form_post callback and JWKS-backed id_token verification; real Apple client config L4 not claimed |
| Google social OAuth provider | Google OpenID Connect, OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/auth/social.ts; apps/server/worker/auth/social-providers.ts; apps/console/src/routes/org/OrgSocialProviders.tsx; apps/server/worker/test-harness/fake-social.ts |
apps/server/worker/auth/__tests__/social.test.ts; apps/server/worker/auth/__tests__/social-providers.test.ts; apps/server/tests/smoke/l3-social-oauth.test.mjs |
/social-login; /hosted-auth |
packages/i18n/locales/**/messages.po |
fake Google social OAuth L3; real Google OAuth client config L4 not claimed |
| Microsoft account social OAuth provider | OIDC Core 1.0 | implemented | L1/L2/L3 | apps/server/worker/auth/social.ts; apps/server/worker/auth/social-providers.ts; apps/console/src/routes/org/OrgSocialProviders.tsx; apps/server/worker/test-harness/fake-social.ts |
apps/server/worker/auth/__tests__/social.test.ts; apps/server/worker/auth/__tests__/social-providers.test.ts; apps/server/tests/smoke/l3-social-oauth.test.mjs |
/social-login; /hosted-auth |
packages/i18n/locales/**/messages.po |
fake Microsoft account social OAuth L3; real client config L4 not claimed |
| GitHub social OAuth provider | OAuth 2.0, GitHub OAuth app behavior | implemented | L1/L2/L3 | apps/server/worker/auth/social.ts; apps/server/worker/auth/social-providers.ts; apps/console/src/routes/org/OrgSocialProviders.tsx; apps/server/worker/test-harness/fake-social.ts |
apps/server/worker/auth/__tests__/social.test.ts; apps/server/tests/smoke/l3-social-oauth.test.mjs |
/social-login; /hosted-auth |
packages/i18n/locales/**/messages.po |
fake GitHub social OAuth L3 callback; real GitHub OAuth app config L4 not claimed |
| Twilio SMS and WhatsApp OTP provider | Twilio Messaging API, XID delivery policy | implemented | L1/L2 | apps/server/worker/auth/delivery-channels.ts; apps/server/worker/queues/sms.ts; apps/server/worker/queues/whatsapp.ts; apps/server/worker/v1/organizations.ts; apps/console/src/routes/org/OrgDeliveryChannels.tsx |
apps/server/worker/queues/__tests__/sms.test.ts; apps/server/worker/queues/__tests__/whatsapp.test.ts; apps/server/worker/v1/__tests__/isolation.test.ts; apps/console/src/routes/org/OrgDeliveryChannels.test.tsx |
/hosted-auth |
packages/i18n/locales/**/messages.po |
Twilio provider queue path with console config; L3 delivery smoke exercises test capture provider only; real Twilio delivery L4 not claimed |
| Meta WhatsApp OTP provider | Meta WhatsApp Cloud API, XID delivery policy | implemented | L1/L2 | apps/server/worker/auth/delivery-channels.ts; apps/server/worker/queues/whatsapp.ts; apps/server/worker/v1/organizations.ts; apps/console/src/routes/org/OrgDeliveryChannels.tsx |
apps/server/worker/queues/__tests__/whatsapp.test.ts; apps/server/worker/v1/__tests__/isolation.test.ts; apps/console/src/routes/org/OrgDeliveryChannels.test.tsx |
/hosted-auth |
packages/i18n/locales/**/messages.po |
Meta WhatsApp queue path with console config; L3 delivery smoke exercises test capture provider only; real Meta delivery L4 not claimed |
| Vonage SMS OTP provider | Vonage SMS API, XID delivery policy | implemented | L1/L2 | apps/server/worker/auth/delivery-channels.ts; apps/server/worker/queues/sms.ts; apps/server/worker/v1/organizations.ts; apps/console/src/routes/org/OrgDeliveryChannels.tsx |
apps/server/worker/queues/__tests__/sms.test.ts; apps/server/worker/v1/__tests__/isolation.test.ts; apps/console/src/routes/org/OrgDeliveryChannels.test.tsx |
/hosted-auth |
packages/i18n/locales/**/messages.po |
Vonage SMS queue path with console config; L3 delivery smoke exercises test capture provider only; real Vonage delivery L4 not claimed |
| Infobip SMS OTP provider | Infobip SMS API, XID delivery policy | implemented | L1/L2 | apps/server/worker/auth/delivery-channels.ts; apps/server/worker/queues/sms.ts; apps/server/worker/v1/organizations.ts; apps/console/src/routes/org/OrgDeliveryChannels.tsx |
apps/server/worker/queues/__tests__/sms.test.ts; apps/server/worker/v1/__tests__/isolation.test.ts; apps/console/src/routes/org/OrgDeliveryChannels.test.tsx |
/hosted-auth |
packages/i18n/locales/**/messages.po |
Infobip SMS queue path with console config; L3 delivery smoke exercises test capture provider only; real Infobip delivery L4 not claimed |
| MessageBird SMS OTP provider | MessageBird SMS API, XID delivery policy | implemented | L1/L2 | apps/server/worker/auth/delivery-channels.ts; apps/server/worker/queues/sms.ts; apps/server/worker/v1/organizations.ts; apps/console/src/routes/org/OrgDeliveryChannels.tsx |
apps/server/worker/queues/__tests__/sms.test.ts; apps/server/worker/v1/__tests__/isolation.test.ts; apps/console/src/routes/org/OrgDeliveryChannels.test.tsx |
/hosted-auth |
packages/i18n/locales/**/messages.po |
MessageBird SMS queue path with console config; L3 delivery smoke exercises test capture provider only; real MessageBird delivery L4 not claimed |
| Audit event hash chain | XID platform operations | implemented | L1 | apps/server/worker/queues/audit.ts; apps/server/worker/durable-objects/audit-seq-do.ts |
apps/server/worker/queues/__tests__/audit.test.ts; apps/server/worker/durable-objects/__tests__/audit-seq-do.test.ts |
/self-hosting |
packages/i18n/locales/**/messages.po |
audit queue and sequence Durable Object tests cover append-only hash chain, genesis hash, prev_hash linkage, tamper detection, and idempotent sequence allocation; production retention verification is not L4 claimed here |
| Audit PII redaction | XID platform operations | implemented | L1 | apps/server/worker/queues/audit-redaction.ts; apps/server/worker/queues/audit.ts |
apps/server/worker/queues/__tests__/audit-redaction.test.ts; apps/server/worker/queues/__tests__/audit.test.ts |
/self-hosting |
packages/i18n/locales/**/messages.po |
audit consumer redacts email, phone, token, secret, credential, OTP, link, URL, password, cookie, authorization, query, and SAMLResponse fields before meta is written and hashed; hash fields and operational status fields are preserved |
| Queue DLQ operations | XID platform operations | implemented | L1/L2 | apps/server/worker/queues/dead-letter.ts; apps/server/worker/crons/hourly.ts; apps/server/worker/platform/dead-letters.ts; packages/db/src/schema/operations.ts; apps/server/wrangler.jsonc |
apps/server/worker/queues/__tests__/dead-letter.test.ts; apps/server/worker/platform/__tests__/platform.test.ts; apps/server/scripts/__tests__/migration-0003-queue-dead-letters.test.mjs |
/self-hosting |
packages/i18n/locales/**/messages.po |
eight independent source DLQs preserve replay routing; D1 stores redacted metadata plus KEK envelope ciphertext only; persistence failures retry and quarantine; verified-instance-manager replay has a five-minute claim lease, rejects concurrent live claims, reclaims or cron-releases stale claims, and is idempotent after completion. Crash recovery is at-least-once. Production Queue delivery and alert L4 are not claimed |
| Worker log privacy boundary | Cloudflare Workers Logs, XID platform operations | implemented | L1 | apps/server/worker/lib/safe-log.ts; apps/server/wrangler.jsonc |
apps/server/worker/lib/__tests__/safe-log.test.ts |
/self-hosting |
packages/i18n/locales/**/messages.po |
application logs expose only structured event metadata and allowlisted error type/code; tests prove messages, stack/cause, cookies, Authorization, URL/query and secrets are absent; production log sampling is 100%, while raw-URL invocation logs and automatic traces with url.full are disabled in every environment; active-account access control, alerts and deployed settings still require L4 verification |
| Webhook delivery | XID event delivery | implemented | L1/L2 | apps/server/worker/v1/webhooks.ts; apps/server/worker/queues/webhook.ts; packages/db/src/schema/operations.ts |
apps/server/worker/v1/__tests__/isolation.test.ts; apps/server/worker/queues/__tests__/webhook.test.ts |
/management-api; /self-hosting |
packages/i18n/locales/**/messages.po |
local Management API and queue tests cover encrypted signing secret creation and rotation, Svix-style HMAC signing, payload and timestamp binding, delivery retry/dead handling, dead-letter snapshot behavior, and stable svix-id per Queue message plus webhook subscription for receiver idempotency; production webhook delivery L4 is not claimed here |
| Webhook verification SDK | XID event delivery | implemented | L1 | packages/backend/src/verify-webhook.ts; packages/backend/src/index.ts |
packages/backend/src/__tests__/verify-webhook.test.ts |
/sdks; /management-api |
packages/i18n/locales/**/messages.po |
backend SDK tests cover Svix-style HMAC verification, svix-id/timestamp/body binding, 5min replay tolerance, tampered payload rejection, wrong-secret rejection, and multi-signature key rotation; production receiver L4 is not claimed here |
| Public docs whitelist | XID docs policy | implemented | L1/L2 | packages/types/src/public-docs.ts; apps/site/src/lib/docs-registry.ts; apps/site/src/content-source/docs/documents.json; apps/site/scripts/sync-document-source.mjs; apps/site/scripts/audit-dist-routes.mjs |
apps/site/src/lib/docs-registry.test.ts; apps/site/scripts/generate-localized-content.test.mjs; apps/site/worker/index.test.ts; apps/site/scripts/audit-dist-routes.mjs |
8-locale product landing, canonical /docs hub, and flat document allowlist |
apps/site/src/content-source/docs/message-descriptors.ts; packages/i18n/locales/**/messages.po |
local Site tests and dist audit prove one product landing, one docs hub, 41 allowlisted documents, and one status page per locale, with Markdown and MDX twins, Pagefind, LLM indexes, sitemap, registered historical detail redirects, and Site 404 blocking for internal docs; production L4 still requires active route-owner and response-header evidence |