andy/blackwall-auth-sdk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity
49 Commits 1 Branch 8 Tags
1.1.0
Commit Graph
39 Commits
Author SHA1 Message Date
Andy Dixon fc80ee1659 docs: add provider security model for sdk integrators 
Introduces security-model guidance covering provider invariants, expected auth failure modes, and integration-safe handling.
 2026-02-26 13:38:45 +00:00
Andy Dixon 1d62f0affd docs: document refresh invalid_grant on scope tightening 
Adds integration guidance that refresh-token exchange may fail after provider-side client scope policy is narrowed.
 2026-02-26 13:34:42 +00:00
Andy Dixon ddc08270a7 docs: document invalid_scope handling and scope allowlist alignment 
Clarifies that requested SDK scopes must be enabled on the provider OAuth client and adds callback-handling guidance for invalid_scope failures.
 2026-02-26 13:30:07 +00:00
Andy Dixon 32208c7701 docs: note cryptbin credential-binding requirements 
Document that new cryptbin items can enforce creating-credential binding for unwrap/update/delete operations in addition to key proof.
 2026-02-26 13:25:20 +00:00
Andy Dixon 62544d86b4 docs: add CIDR trusted-proxy guidance 
Clarify trusted-proxy configuration can use explicit IP/CIDR entries and should remain narrowly scoped for abuse-control integrity.
 2026-02-26 13:23:29 +00:00
Andy Dixon 35d58ff07b docs: add CSV import limit guidance for bulk admin flows 
Document operational expectations for CSV file-size and row-count limits during provider bulk-user import automation.
 2026-02-26 13:17:28 +00:00
Andy Dixon 464524da27 docs: note serialized decision behavior for approval actions 
Clarify that approve/reject/cancel decisions for a single approval request should be treated as serialized and not submitted in parallel.
 2026-02-26 13:16:32 +00:00
Andy Dixon 8bb3c1ce12 docs: note JWT revocation-aware userinfo behavior 
Update integration guidance that revoked JWT access tokens are now rejected on provider userinfo before natural expiry.
 2026-02-26 13:00:51 +00:00
Andy Dixon bbcada1317 docs: clarify idempotent retry expectations for approval flows 
Document serialized approval execution expectations and recommend bounded idempotent client retries for admin mutation workflows.
 2026-02-26 12:58:50 +00:00
Andy Dixon 878e2b98e6 docs: add reverse-proxy IP header hardening guidance 
Document strict trusted-proxy configuration requirements to avoid spoofed client IP forwarding affecting abuse controls.
 2026-02-26 12:42:10 +00:00
Andy Dixon 6cc2ddabd0 docs: require non-URL handling for enrollment links 
Clarify that enrollment URLs are sensitive bearer material and must not be transported in redirect query strings or logs.
 2026-02-26 12:40:33 +00:00
Andy Dixon fb60a1eccb docs: document introspection active=false on disabled subjects 
Clarify SDK integration guidance that provider introspection can return active=false when user/project/client is disabled after token issuance.
 2026-02-26 12:38:45 +00:00
Andy Dixon ebea82f63d docs: add CSV export formula-injection handling guidance 
Document that provider CSV exports should be handled with formula-injection safety when opened in spreadsheet tooling.
 2026-02-26 12:35:02 +00:00
Andy Dixon 3d3493e546 docs: require POST+CSRF for admin enrollment export calls 
Document provider hardening change: enrollment URL export is state-changing and must be invoked with POST plus CSRF token, not GET links.
 2026-02-26 12:33:51 +00:00
Andy Dixon 822b9b93c5 docs: document cryptbin unwrap key proof requirement 
Update SDK security guidance/examples to note that provider cryptbin unwrap calls must include key_b64url and now fail with 403 Forbidden on key mismatch.
 2026-02-26 12:31:11 +00:00
Andy Dixon ba8868cc12 docs: note stricter limits on high-cost report/export endpoints 
Extend integration guidance to account for stricter abuse controls on provider report/export style endpoints.
 2026-02-26 12:28:11 +00:00
Andy Dixon 78606bf751 docs: note disabled projects may be omitted from assignment views 
Clarify integration expectation that provider-side project visibility can be restricted to active projects, even when historical assignments remain.
 2026-02-26 12:27:25 +00:00
Andy Dixon d97638201e docs: include consent-time access_denied for inactive accounts 
Clarify that provider-side active-account enforcement can reject OAuth consent submission when account status changes during the authorization session.
 2026-02-26 12:26:45 +00:00
Andy Dixon df7ca1329e docs: note session invalidation behavior for disabled accounts 
Document that provider-side account disablement can invalidate existing authenticated sessions, not just new login attempts.
 2026-02-26 12:22:20 +00:00
Andy Dixon 8b7f11fc6a docs: note disabled-account failures during WebAuthn login verification 
Clarify that provider WebAuthn login verification may reject disabled accounts with credential-style failures despite valid authenticator assertions.
 2026-02-26 12:21:30 +00:00
Andy Dixon cdef7da4b9 docs: align state/nonce/PKCE format expectations with provider validation 
Document provider-side strict validation for OAuth authorization request parameters so integrations generate URL-safe, spec-conformant state/nonce/PKCE values.
 2026-02-26 12:07:18 +00:00
Andy Dixon f51997016d docs: note disabled-account access_denied outcomes during auth flow 
Clarify that account status changes (disabled) may surface as access_denied during provider login/authorization, and integrations should handle these outcomes explicitly.
 2026-02-26 12:06:19 +00:00
Andy Dixon 49265eee0f docs: note invalid_grant on inactive subject state during token exchange 
Extend SDK integration guidance to cover provider-side active-state enforcement at token issuance, where invalid_grant may be returned if client/user/project is inactive.
 2026-02-26 12:05:06 +00:00
Andy Dixon 4d612b57f4 docs: require single OAuth client auth method per request 
Document that integrations must not mix HTTP Basic and client_secret form authentication on the same token/control endpoint request, aligning with provider-side hardening.
 2026-02-26 12:03:33 +00:00
Andy Dixon f9323110ce docs: prohibit URL query transport of secrets and tokens 
Update SDK security guidance to explicitly forbid placing client secrets or bearer tokens in URL query strings, matching provider-side hardening against secret leakage.
 2026-02-26 12:02:21 +00:00
Andy Dixon 12cefe68e8 docs: clarify provider rate limits may be source-identity scoped 
Add integration guidance that provider abuse controls can apply across related auth endpoints based on source identity, reinforcing backoff and retry discipline.
 2026-02-26 11:53:25 +00:00
Andy Dixon 78a18ccfab docs: handle userinfo invalid_token outcomes in callback example 
Update SDK example callback and integration guidance to treat UserInfoException as an authorization-state outcome (e.g. subject disabled/inactive scope) and return a clear 403 path.
 2026-02-26 11:51:29 +00:00
Andy Dixon 7bb919a0a0 docs: recommend bounded retry/backoff for token exchange failures 
Update integration guidance to avoid tight retry loops during transient token endpoint failures by using bounded backoff strategies.
 2026-02-26 11:48:40 +00:00
Andy Dixon 60f6989595 docs: add userinfo 429 backoff guidance 
Extend integration guidance to cover provider-side abuse controls on userinfo lookups, advising retry/backoff handling for 429 responses.
 2026-02-26 11:47:15 +00:00
Andy Dixon 066a0b8fb7 docs: require HTTPS redirect URIs except localhost loopback dev 
Align SDK integration guidance with provider redirect URI hardening: use HTTPS callback URLs in production and limit HTTP callbacks to localhost loopback during development/testing.
 2026-02-26 11:46:31 +00:00
Andy Dixon d4a6418e5d docs: specify POST-only usage for provider WebAuthn challenge/verify endpoints 
Clarify integration expectations that provider-side WebAuthn login challenge and verify endpoints should be invoked via POST methods only.
 2026-02-26 11:40:31 +00:00
Andy Dixon 7d0319332f docs: clarify callback access_denied causes include privilege changes 
Update integration guidance so consuming apps treat access_denied as an expected provider authorization result when membership or privilege state changes during the OAuth consent flow.
 2026-02-26 11:39:50 +00:00
Andy Dixon 44aa9e6f80 docs: note 429 backoff expectations for provider control endpoints 
Document that integrations should expect provider-side abuse controls on OAuth control endpoints and handle 429 responses with retry/backoff semantics.
 2026-02-26 11:38:56 +00:00
Andy Dixon f529714f45 docs: handle OAuth callback access_denied outcomes from stricter provider authz 
Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
 2026-02-26 11:36:17 +00:00
Andy Dixon 6ddbcaec70 docs: add OIDC nonce guidance and callback error handling 2026-02-26 11:11:47 +00:00
Andy Dixon 3ff5b7aa26 Security hardening: enforce secure URLs and transport safeguards 2026-02-26 09:10:09 +00:00
Andy Dixon 94c85fc8d5 Release 1.0.1: normalized userinfo and callback helper 2026-02-26 09:07:11 +00:00
Andy Dixon 1ed5bd6bd3 Changed base blackwall URL 2026-02-13 13:51:59 +00:00
Andy Dixon 57637840a5 Initial Commit 2026-02-10 09:17:22 +00:00