golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(19.4): coverage matrix passes the api-coverage lint

Browse Source
This commit is contained in:
Jakub Zych
2026-10-19 22:17:12 +02:00
parent 4d32d96395
commit a04fe6bf32
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
.planning/phases/19.4-oidc-provider-on-wristband/COVERAGE.md
View File

@@ -2,23 +2,23 @@
> Full coverage by default. Opt-outs are explicit, reasoned decisions.
No external API integration: phase 19.4 implements an OpenID Connect provider; it calls no third-party service at runtime. The detector matched because the plans talk about OAuth endpoints, MCP and "wire bytes" of our own surface. The only outside libraries are golang-jwt v5 (already in go.mod, used to sign) and, test-only, go-oidc v3.21.0 with x/oauth2 v0.37.0 acting as a stock relying party (plan 02, after a blocking human package check).
Phase 19.4 calls no third-party API: it implements an OpenID Connect provider; it calls no third-party service at runtime. The detector matched because the plans talk about OAuth endpoints, MCP and "wire bytes" of our own surface. The only outside libraries are golang-jwt v5 (already in go.mod, used to sign) and, test-only, go-oidc v3.21.0 with x/oauth2 v0.37.0 acting as a stock relying party (plan 02, after a blocking human package check).
The "API" that matters here is the relying-party-visible contract of the PHP `Golem15.OAuthServer` plugin, which D-14 makes the acceptance test. The matrix below records which OIDC and OAuth capabilities the Go provider implements (INTEGRATE) and which it leaves out on purpose (OPT-OUT), so a relying party's expectations can be checked against it.
| capability | decision | reason |
|---|---|---|
| discovery: /.well-known/openid-configuration with PHP's 14 fields in PHP order, Cache-Control max-age=3600, public | INTEGRATE | D-14; plan 01 |
| discovery: /.well-known/openid-configuration, PHP's 14 fields in PHP order | INTEGRATE | D-14; plan 01; Cache-Control max-age=3600, public |
| discovery: subject_types_supported public and pairwise | INTEGRATE | D-15 (beyond PHP, roadmap asks for pairwise) |
| discovery: id_token_signing_alg_values_supported from the key ring | INTEGRATE | D-12 |
| discovery: refresh_token grant and offline_access scope advertised | INTEGRATE | only when refresh.enabled (D-17); otherwise byte-identical to PHP |
| jwks: active key plus retired keys inside the grace window, RSA and EC JWKs with use, alg, kid | INTEGRATE | D-12, D-13 |
| authorize: authorization code with mandatory S256 PKCE, PHP validation order and messages | INTEGRATE | D-14 |
| authorize: rendered local errors for unknown client, redirect mismatch, inactive client, expired request | INTEGRATE | RFC 6749 §4.1.2.1 as PHP |
| jwks: active key plus retired keys inside the grace window | INTEGRATE | D-12, D-13; RSA and EC JWKs with use, alg, kid |
| authorize: authorization code with mandatory S256 PKCE | INTEGRATE | D-14; PHP validation order and messages |
| authorize: rendered local error pages | INTEGRATE | RFC 6749 §4.1.2.1 as PHP: unknown client, redirect mismatch, inactive client, expired request |
| authorize: login handoff to login_url with only the resume path | INTEGRATE | D-04 |
| authorize: resume, silent consent, incremental consent, deny, switch account | INTEGRATE | D-04, SC-3 |
| authorize: one-shot consent CSRF token bound to the user | INTEGRATE | PHP ConsentCsrf |
| authorize: SPA consent mode (redirect to the app's consent page plus JSON endpoints) | INTEGRATE | D-03 option |
| authorize: SPA consent mode | INTEGRATE | D-03 option: redirect to the app's consent page plus JSON endpoints |
| authorize: is_dev loopback port exception | INTEGRATE | PHP RedirectUriMatcher |
| authorize: prompt, max_age, login_hint, resource parameters | OPT-OUT | PHP ignores them; parity (D-14) |
| authorize: response_type token or id_token (implicit, hybrid) | OPT-OUT | code flow only, as PHP; implicit is deprecated by OAuth 2.1 |
@@ -29,22 +29,22 @@ The "API" that matters here is the relying-party-visible contract of the PHP `Go
| token: refresh_token grant with rotation and lineage revocation | INTEGRATE | opt-in per client and per server (D-17) |
| token: client_secret_jwt, private_key_jwt, none (public OIDC clients) | OPT-OUT | PHP accepts confidential clients only; public clients stay on the MCP flavour |
| token: burn-then-check code redemption and replay revocation | INTEGRATE | PHP PkceAndReplay contract |
| id_token: iss, sub, aud (string), exp, iat, nonce, at_hash, allowlisted identity claims | INTEGRATE | PHP TokenIssuer |
| id_token: iss, sub, aud, exp, iat, nonce, at_hash, allowlisted identity claims | INTEGRATE | PHP TokenIssuer; aud is a string |
| id_token: auth_time, azp, acr, amr, jti | OPT-OUT | PHP emits none; adding them changes the claim set relying parties see |
| id_token: ES256 signing | INTEGRATE | D-12 (configurable for new keys) |
| id_token: encryption (JWE) | OPT-OUT | not in the PHP contract |
| userinfo: GET with Bearer, scope-filtered claims, uniform 401 with empty body | INTEGRATE | PHP contract |
| userinfo: POST, signed or encrypted responses | OPT-OUT | PHP serves GET only and plain JSON |
| claims parameter, distributed and aggregated claims | OPT-OUT | not in the PHP contract |
| authorized apps: GET /oauth/authorizations and DELETE /oauth/authorizations/{client_id} | INTEGRATE | SC-3, PHP AuthorizationsController |
| authorized apps: GET and DELETE /oauth/authorizations[/{client_id}] | INTEGRATE | SC-3, PHP AuthorizationsController |
| OPTIONS preflight on /oauth/authorizations without a CORS profile | OPT-OUT | pact.Router has no OPTIONS verb; with cors_profile set the surf CORS profile answers preflight; recorded as a parity deviation |
| key management: database ring, lazy first key, rotate-keys, grace window, prune | INTEGRATE | D-10, D-13 |
| scheduled rotation | INTEGRATE | opt-in through rotation_interval (D-13) |
| scheduled prune of codes, tokens, requests, retired keys | INTEGRATE | SC-3 |
| import of the six PHP tables, key_dir with original kids, branding settings and logos | INTEGRATE | D-11, D-19, RESEARCH OQ8 |
| import: the six PHP tables, key_dir with original kids, branding and logos | INTEGRATE | D-11, D-19, RESEARCH OQ8 |
| token introspection (RFC 7662) | OPT-OUT | access tokens are opaque and used only at userinfo, as PHP |
| token revocation endpoint (RFC 7009) | OPT-OUT | not in the PHP contract; users revoke through /oauth/authorizations |
| RP-initiated logout, end_session_endpoint, check_session, front- and back-channel logout | OPT-OUT | not in the PHP contract; switch-account covers the session change PHP supports |
| RP-initiated logout and session management | OPT-OUT | end_session_endpoint, check_session, front/back-channel logout: not in the PHP contract; switch-account covers the session change PHP supports |
| dynamic client registration for OIDC clients | OPT-OUT | D-08: registration is MCP-only, so a registered client never gets identity scopes |
| sector_identifier_uri fetching for pairwise clients | OPT-OUT | RESEARCH OQ5: the administrator enters the sector; no remote fetch in this phase |
| device authorization grant | OPT-OUT | Phase 19.6 |