From a04fe6bf32b2d70d077a7b06cb377816cef52d0e Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 19 Oct 2026 22:17:12 +0200 Subject: [PATCH] docs(19.4): coverage matrix passes the api-coverage lint --- .../COVERAGE.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.planning/phases/19.4-oidc-provider-on-wristband/COVERAGE.md b/.planning/phases/19.4-oidc-provider-on-wristband/COVERAGE.md index 6c5cfd92..d39f3d89 100644 --- a/.planning/phases/19.4-oidc-provider-on-wristband/COVERAGE.md +++ b/.planning/phases/19.4-oidc-provider-on-wristband/COVERAGE.md @@ -2,23 +2,23 @@ > Full coverage by default. Opt-outs are explicit, reasoned decisions. -No external API integration: phase 19.4 implements an OpenID Connect provider; it calls no third-party service at runtime. The detector matched because the plans talk about OAuth endpoints, MCP and "wire bytes" of our own surface. The only outside libraries are golang-jwt v5 (already in go.mod, used to sign) and, test-only, go-oidc v3.21.0 with x/oauth2 v0.37.0 acting as a stock relying party (plan 02, after a blocking human package check). +Phase 19.4 calls no third-party API: it implements an OpenID Connect provider; it calls no third-party service at runtime. The detector matched because the plans talk about OAuth endpoints, MCP and "wire bytes" of our own surface. The only outside libraries are golang-jwt v5 (already in go.mod, used to sign) and, test-only, go-oidc v3.21.0 with x/oauth2 v0.37.0 acting as a stock relying party (plan 02, after a blocking human package check). The "API" that matters here is the relying-party-visible contract of the PHP `Golem15.OAuthServer` plugin, which D-14 makes the acceptance test. The matrix below records which OIDC and OAuth capabilities the Go provider implements (INTEGRATE) and which it leaves out on purpose (OPT-OUT), so a relying party's expectations can be checked against it. | capability | decision | reason | |---|---|---| -| discovery: /.well-known/openid-configuration with PHP's 14 fields in PHP order, Cache-Control max-age=3600, public | INTEGRATE | D-14; plan 01 | +| discovery: /.well-known/openid-configuration, PHP's 14 fields in PHP order | INTEGRATE | D-14; plan 01; Cache-Control max-age=3600, public | | discovery: subject_types_supported public and pairwise | INTEGRATE | D-15 (beyond PHP, roadmap asks for pairwise) | | discovery: id_token_signing_alg_values_supported from the key ring | INTEGRATE | D-12 | | discovery: refresh_token grant and offline_access scope advertised | INTEGRATE | only when refresh.enabled (D-17); otherwise byte-identical to PHP | -| jwks: active key plus retired keys inside the grace window, RSA and EC JWKs with use, alg, kid | INTEGRATE | D-12, D-13 | -| authorize: authorization code with mandatory S256 PKCE, PHP validation order and messages | INTEGRATE | D-14 | -| authorize: rendered local errors for unknown client, redirect mismatch, inactive client, expired request | INTEGRATE | RFC 6749 §4.1.2.1 as PHP | +| jwks: active key plus retired keys inside the grace window | INTEGRATE | D-12, D-13; RSA and EC JWKs with use, alg, kid | +| authorize: authorization code with mandatory S256 PKCE | INTEGRATE | D-14; PHP validation order and messages | +| authorize: rendered local error pages | INTEGRATE | RFC 6749 §4.1.2.1 as PHP: unknown client, redirect mismatch, inactive client, expired request | | authorize: login handoff to login_url with only the resume path | INTEGRATE | D-04 | | authorize: resume, silent consent, incremental consent, deny, switch account | INTEGRATE | D-04, SC-3 | | authorize: one-shot consent CSRF token bound to the user | INTEGRATE | PHP ConsentCsrf | -| authorize: SPA consent mode (redirect to the app's consent page plus JSON endpoints) | INTEGRATE | D-03 option | +| authorize: SPA consent mode | INTEGRATE | D-03 option: redirect to the app's consent page plus JSON endpoints | | authorize: is_dev loopback port exception | INTEGRATE | PHP RedirectUriMatcher | | authorize: prompt, max_age, login_hint, resource parameters | OPT-OUT | PHP ignores them; parity (D-14) | | authorize: response_type token or id_token (implicit, hybrid) | OPT-OUT | code flow only, as PHP; implicit is deprecated by OAuth 2.1 | @@ -29,22 +29,22 @@ The "API" that matters here is the relying-party-visible contract of the PHP `Go | token: refresh_token grant with rotation and lineage revocation | INTEGRATE | opt-in per client and per server (D-17) | | token: client_secret_jwt, private_key_jwt, none (public OIDC clients) | OPT-OUT | PHP accepts confidential clients only; public clients stay on the MCP flavour | | token: burn-then-check code redemption and replay revocation | INTEGRATE | PHP PkceAndReplay contract | -| id_token: iss, sub, aud (string), exp, iat, nonce, at_hash, allowlisted identity claims | INTEGRATE | PHP TokenIssuer | +| id_token: iss, sub, aud, exp, iat, nonce, at_hash, allowlisted identity claims | INTEGRATE | PHP TokenIssuer; aud is a string | | id_token: auth_time, azp, acr, amr, jti | OPT-OUT | PHP emits none; adding them changes the claim set relying parties see | | id_token: ES256 signing | INTEGRATE | D-12 (configurable for new keys) | | id_token: encryption (JWE) | OPT-OUT | not in the PHP contract | | userinfo: GET with Bearer, scope-filtered claims, uniform 401 with empty body | INTEGRATE | PHP contract | | userinfo: POST, signed or encrypted responses | OPT-OUT | PHP serves GET only and plain JSON | | claims parameter, distributed and aggregated claims | OPT-OUT | not in the PHP contract | -| authorized apps: GET /oauth/authorizations and DELETE /oauth/authorizations/{client_id} | INTEGRATE | SC-3, PHP AuthorizationsController | +| authorized apps: GET and DELETE /oauth/authorizations[/{client_id}] | INTEGRATE | SC-3, PHP AuthorizationsController | | OPTIONS preflight on /oauth/authorizations without a CORS profile | OPT-OUT | pact.Router has no OPTIONS verb; with cors_profile set the surf CORS profile answers preflight; recorded as a parity deviation | | key management: database ring, lazy first key, rotate-keys, grace window, prune | INTEGRATE | D-10, D-13 | | scheduled rotation | INTEGRATE | opt-in through rotation_interval (D-13) | | scheduled prune of codes, tokens, requests, retired keys | INTEGRATE | SC-3 | -| import of the six PHP tables, key_dir with original kids, branding settings and logos | INTEGRATE | D-11, D-19, RESEARCH OQ8 | +| import: the six PHP tables, key_dir with original kids, branding and logos | INTEGRATE | D-11, D-19, RESEARCH OQ8 | | token introspection (RFC 7662) | OPT-OUT | access tokens are opaque and used only at userinfo, as PHP | | token revocation endpoint (RFC 7009) | OPT-OUT | not in the PHP contract; users revoke through /oauth/authorizations | -| RP-initiated logout, end_session_endpoint, check_session, front- and back-channel logout | OPT-OUT | not in the PHP contract; switch-account covers the session change PHP supports | +| RP-initiated logout and session management | OPT-OUT | end_session_endpoint, check_session, front/back-channel logout: not in the PHP contract; switch-account covers the session change PHP supports | | dynamic client registration for OIDC clients | OPT-OUT | D-08: registration is MCP-only, so a registered client never gets identity scopes | | sector_identifier_uri fetching for pairwise clients | OPT-OUT | RESEARCH OQ5: the administrator enters the sector; no remote fetch in this phase | | device authorization grant | OPT-OUT | Phase 19.6 |