A comprehensive enterprise engineering roadmap, security specification, and architectural backlog for @observability/auth.
Priority Tier Definitions:
- P0 (Critical Live Production Blocker): Existing gaps in live v1.0 that present active security or operational risk.
- P1 (Immediate Milestone v1.1): Core security hardening, credential lifecycle, and compliance requirements.
- P2 (Scaled Enterprise v1.2): Advanced authentication primitives, adaptive risk heuristics, and session controls.
- P3 (Federation & Architecture v1.3+): Enterprise directory federation, graph authorization, and zero-trust infrastructure.
| Domain | Capability | RFC / Standard | Current Status | Milestone | Priority |
|---|---|---|---|---|---|
| Session Management | Scoped JWT Issuance (sub, org, role) | RFC 7519 | ✅ Completed | Production v1.0 | Core |
| Session Management | Direct Redis $O(1)$ Denylist TTL (ADR 0004 Kill Switch) | ADR 0004 | ⏳ Pending | v1.0-hotfix | P0 |
| Security & Defense | Login Rate Limiting (IP Lockout + Email CAPTCHA/Backoff) | RFC 6585 | ⏳ Pending | v1.0-hotfix | P0 |
| API Key Engine | 3-Tier API Keys (ak_gen_, ak_tst_, ak_sec_) | Structured Prefixes | ✅ Completed | Production v1.0 | Core |
| API Key Engine | Key Expiration (expires_at_ms) & Instant Revocation for ak_sec_ | TTL Enforced | ⏳ Pending | v1.0-hotfix | P0 |
| Notifications | Transactional Mailer Adapter (SMTP / SES / SendGrid) | MIME RFC 2045 | ⏳ Pending | v1.0-hotfix | P0 |
| Core Authentication | Email & Password Registration & Login (Argon2id) | RFC 9106 | ✅ Completed | Production v1.0 | Core |
| Security & Defense | Step-Up Authentication for High-Value Actions (incl. Impersonation) | RFC 9470 | ⏳ Pending | v1.1 | P1 |
| Core Authentication | Multi-Factor Authentication (RFC 6238 TOTP + Hashed Recovery Codes) | RFC 6238 | ⏳ Pending | v1.1 | P1 |
| Session Management | Refresh Token Rotation & Family Reuse Detection | RFC 6749 §10.4 | ⏳ Pending | v1.1 | P1 |
| Core Authentication | Breached Password Screening (HaveIBeenPwned k-Anonymity) | NIST SP 800-63B | ⏳ Pending | v1.1 | P1 |
| User Lifecycle | Automated 30-Day Cascade Soft-Delete Purge Cron Worker | GDPR Article 17 | ⏳ Pending | v1.1 | P1 |
| Audit & Compliance | GDPR Data Subject Access Request (DSAR) JSON Export | GDPR Article 15 | ⏳ Pending | v1.1 | P1 |
| Security & Defense | Automated Security Headers & Strict CSP (Nonces) | W3C CSP Level 3 | ⏳ Pending | v1.1 | P1 |
| Enterprise Identity | OAuth2 / OIDC Social Login (Google, GitHub, GitLab) | RFC 6749 / OIDC | ⏳ Pending | v1.1 | P1 |
| Core Authentication | WebAuthn / FIDO2 Passkeys (Biometrics & Hardware Keys) | W3C WebAuthn L3 | ⏳ Pending | v1.2 | P2 |
| Session Management | Multi-Device Session Listing & Remote Kill | OWASP ASVS 3.3 | ⏳ Pending | v1.2 | P2 |
| Security & Defense | Unified Adaptive Risk-Based Authentication (Soft Step-Up) | NIST SP 800-63-3 | ⏳ Pending | v1.2 | P2 |
| Enterprise Identity | Organization Domain Claiming & Verified Auto-Join | DNS TXT + Email Gate | ⏳ Pending | v1.2 | P2 |
| API Key Engine | IP / CIDR Subnet Allowlist & Usage Analytics Telemetry | Zero-Trust Network | ⏳ Pending | v1.2 | P2 |
| Access Control (RBAC/ABAC) | Custom Enterprise Roles & 64-bit Permission Bitmasks | Granular Bitmask Engine | ⏳ Pending | v1.2 | P2 |
| User Lifecycle | Password History Enforcement (Disallow Prior 10 Passwords) | NIST SP 800-63B | ⏳ Pending | v1.2 | P2 |
| Core Authentication | Magic Link / Passwordless Authentication Flow | RFC 7519 | ⏳ Pending | v1.2 | P2 |
| Security & Defense | Anti-Homoglyph & Unicode Normalization Shield | Unicode TR39 / NFKC | ⏳ Pending | v1.2 | P2 |
| Security & Defense | Webhook Cryptographic Signatures & Anti-Replay Nonces | RFC 2104 HMAC-SHA256 | ⏳ Pending | v1.2 | P2 |
| Multi-Tenancy | Organization CRUD & Multi-Tenant Context Switch | Multi-Tenant Isolated | ✅ Completed | Production v1.0 | Core |
| Multi-Tenancy | Row-Level Security (RLS) Tenant Isolation | Postgres RLS | ✅ Completed | Production v1.0 | Core |
| Access Control (RBAC/ABAC) | Role Hierarchy Engine (Owner > Admin > Member > Viewer) | Hierarchical RBAC | ✅ Completed | Production v1.0 | Core |
| User Lifecycle | Member Invites, Roles, Permissions Table | Team Collaboration | ✅ Completed | Production v1.0 | Core |
| User Lifecycle | Account Blocking & 30-Day Cascade Soft-Delete Marking | Lifecycle State Machine | ✅ Completed | Production v1.0 | Core |
| Audit & Compliance | Event Audit Logging & Parameterized Query Filters | SOC 2 / HIPAA CC7.2 | ✅ Completed | Production v1.0 | Core |
| Enterprise Identity | Full OAuth 2.0 / OIDC Identity Provider (Auth Code + PKCE) | RFC 7636 / RFC 6749 | ⏳ Pending | v1.3 | P3 |
| Enterprise Identity | SCIM 2.0 Automated User & Group Directory Provisioning | RFC 7643 / RFC 7644 | ⏳ Pending | v1.3 | P3 |
| Enterprise Identity | Enterprise SAML 2.0 Service Provider Federation | SAML 2.0 Core | ⏳ Pending | v1.3 | P3 |
| Enterprise Identity | Machine-to-Machine (M2M) Client Credentials Grant | RFC 6749 §4.4 | ⏳ Pending | v1.3 | P3 |
| Session Management | Standardized EdDSA (Ed25519) JWKS Key Rotation | RFC 8037 EdDSA | ⏳ Pending | v1.3 | P3 |
| Access Control (RBAC/ABAC) | Relationship-Based Access Control (ReBAC / Zanzibar Graphs) | Google Zanzibar Model | ⏳ Pending | v1.3 | P3 |
| Access Control (RBAC/ABAC) | Monitored Break-Glass Emergency Access Workflow | SOC 2 CC6.1 / CC6.2 | ⏳ Pending | v1.3 | P3 |
| Security & Defense | Field-Level PII Envelope Encryption (AES-256-GCM / KMS) | NIST SP 800-38D | ⏳ Pending | v1.3 | P3 |
| Security & Defense | Cryptographic Shredding (GDPR Art. 17 User DEKs) | GDPR Article 17 | ⏳ Pending | v1.3 | P3 |
| Security & Defense | Distributed Credential Stuffing & ASN Velocity Defense | Threat Intelligence | ⏳ Pending | v1.3 | P3 |
| Security & Defense | Mutual TLS (mTLS) Zero-Trust Microservice Authentication | RFC 8705 / TLS 1.3 | ⏳ Pending | v1.3 | P3 |
| Security & Defense | Honeytokens & Active Canary Secret Scanning | Deception Technology | ⏳ Pending | v1.3 | P3 |
| Audit & Compliance | Immutable WORM Audit Archive (S3 Object Lock / Glacier) | SEC Rule 17a-4(f) | ⏳ Pending | v1.3 | P3 |
| Developer Experience | Database Seed Script (npm run db:seed) | Developer Fixtures | ⏳ Pending | v1.1 | P1 |
Content type
Image
Digest
sha256:e68ea5de4…
Size
61 MB
Last updated
about 1 month ago
docker pull chiefj/llm-obs-auth