alpha
Login
or
Join now
tynanpurdy.com
/
atauth
Star
7
Fork
0
Atom
Configure Feed
Issues
Pull Requests
Commits
Tags
Feed URL
Select the types of activity you want to include in your feed.
AtAuth
Star
7
Fork
0
Atom
Configure Feed
Issues
Pull Requests
Commits
Tags
Feed URL
Select the types of activity you want to include in your feed.
Overview
Issues
Pulls
Pipelines
atauth
/
gateway
/
src
/
types
/
at
main
6 files
tynanpurdy.com
update atproto auth scope to `atproto account:email` instead of `transition:generic`
5w ago
469f5f87
email.ts
update atproto auth scope to `atproto account:email` instead of `transition:generic`
1 month ago
index.ts
update atproto auth scope to `atproto account:email` instead of `transition:generic`
1 month ago
mfa.ts
feat: Add OIDC provider, passkeys, MFA, and admin UI Major feature release transforming ATAuth into a full SSO provider: ## OIDC Provider - OpenID Connect discovery endpoints (/.well-known/*) - Authorization, token, userinfo, revocation endpoints - ES256/RS256 JWT signing with key rotation - PKCE support for public clients ## Authentication Methods - Passkey/WebAuthn support for passwordless login - TOTP MFA with backup codes - Email verification and account recovery ## Admin UI - React + TailwindCSS admin dashboard - Manage legacy apps and OIDC clients - Session management and user administration - Signing key rotation ## Deployment - Multi-stage Docker build with admin UI - Kubernetes manifests with staging/production overlays - Helm chart for flexible deployment - Gitea Actions and Tekton CI/CD pipelines - Database backup CronJob - Safe deployment runbook ## Backward Compatibility - Legacy HMAC token flow unchanged - Existing /auth/* routes preserved - New features are additive (new tables only)
5 months ago
oidc.ts
feat: per-client access rules for OIDC and Legacy HMAC apps Add user-level access gating to OIDC clients and Legacy HMAC apps, matching the existing forward-auth proxy access control pattern. - New `client_access_rules` table for per-client allow/deny rules - New `require_access_check` flag on apps table (default: off) - Enforcement in OIDC authorize callback + passkey flow - Enforcement in Legacy HMAC auth callback - Admin API: CRUD endpoints + dry-run access check - Generic `checkAccess()` now works with both proxy and client rules - 19 new tests (423 total, all passing) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
4 months ago
passkey.ts
feat: Add OIDC provider, passkeys, MFA, and admin UI Major feature release transforming ATAuth into a full SSO provider: ## OIDC Provider - OpenID Connect discovery endpoints (/.well-known/*) - Authorization, token, userinfo, revocation endpoints - ES256/RS256 JWT signing with key rotation - PKCE support for public clients ## Authentication Methods - Passkey/WebAuthn support for passwordless login - TOTP MFA with backup codes - Email verification and account recovery ## Admin UI - React + TailwindCSS admin dashboard - Manage legacy apps and OIDC clients - Session management and user administration - Signing key rotation ## Deployment - Multi-stage Docker build with admin UI - Kubernetes manifests with staging/production overlays - Helm chart for flexible deployment - Gitea Actions and Tekton CI/CD pipelines - Database backup CronJob - Safe deployment runbook ## Backward Compatibility - Legacy HMAC token flow unchanged - Existing /auth/* routes preserved - New features are additive (new tables only)
5 months ago
proxy.ts
feat: per-client access rules for OIDC and Legacy HMAC apps Add user-level access gating to OIDC clients and Legacy HMAC apps, matching the existing forward-auth proxy access control pattern. - New `client_access_rules` table for per-client allow/deny rules - New `require_access_check` flag on apps table (default: off) - Enforcement in OIDC authorize callback + passkey flow - Enforcement in Legacy HMAC auth callback - Admin API: CRUD endpoints + dry-run access check - Generic `checkAccess()` now works with both proxy and client rules - 19 new tests (423 total, all passing) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
4 months ago