119 lines
7.0 KiB
JSON
119 lines
7.0 KiB
JSON
{
|
|
"module": "authority",
|
|
"lastUpdated": "2026-02-13T00:00:00Z",
|
|
"featureCount": 13,
|
|
"summary": {
|
|
"passed": 13,
|
|
"failed": 0,
|
|
"blocked": 0,
|
|
"done": 13
|
|
},
|
|
"buildNote": "Baseline: 14 test projects, 861 total tests (Authority.Core.Tests=46, Authority.Persistence.Tests=75, Authority.Timestamping.Tests=16, Authority.Timestamping.Abstractions.Tests=16, Authority.ConfigDiff.Tests=5, Authority.Tests=317, Auth.Abstractions.Tests=103, Auth.Client.Tests=28, Auth.ServerIntegration.Tests=27, Authority.Plugin.Ldap.Tests=75, Authority.Plugin.Oidc.Tests=44, Authority.Plugin.Saml.Tests=38, Authority.Plugin.Standard.Tests=39, Authority.Plugins.Abstractions.Tests=32). All 861 tests pass.",
|
|
"features": [
|
|
{
|
|
"name": "authority-identity-provider-registry",
|
|
"slug": "authority-identity-provider-registry",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/authority-identity-provider-registry/run-001/tier2-integration-check.json",
|
|
"notes": "Registry indexes providers, aggregates capabilities, AcquireAsync returns scoped instances, duplicate handling, selector routes by parameter. 7 targeted tests all pass."
|
|
},
|
|
{
|
|
"name": "authority-module-with-oidc-oauth2-dpop-mtls",
|
|
"slug": "authority-module-with-oidc-oauth2-dpop-mtls",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/authority-module-with-oidc-oauth2-dpop-mtls/run-001/tier2-integration-check.json",
|
|
"notes": "Full OIDC/OAuth2 flows with DPoP, mTLS, client credentials, password grant, refresh tokens, revocation, discovery, tamper inspection. 50+ targeted tests."
|
|
},
|
|
{
|
|
"name": "authority-plugin-system",
|
|
"slug": "authority-plugin-system",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/authority-plugin-system/run-001/tier2-integration-check.json",
|
|
"notes": "Plugin loader, 5 concrete plugins (Standard=39, LDAP=75, OIDC=44, SAML=38 tests), assembly discovery, registration lifecycle. 196+ tests."
|
|
},
|
|
{
|
|
"name": "authority-sealed-mode-evidence-validator",
|
|
"slug": "authority-sealed-mode-evidence-validator",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/authority-sealed-mode-evidence-validator/run-001/tier2-integration-check.json",
|
|
"notes": "Evidence freshness validation, missing file handling, stale evidence detection, airgap audit endpoints, offline kit audit. Meaningful assertions with specific failure codes."
|
|
},
|
|
{
|
|
"name": "cli-dpop-bound-authentication",
|
|
"slug": "cli-dpop-bound-authentication",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/cli-dpop-bound-authentication/run-001/tier2-integration-check.json",
|
|
"notes": "28 Auth.Client tests cover DPoP proof generation, token binding, file/inmemory/messaging caches, bearer token handler, auth modes. Server-side DPoP validation in Authority.Tests."
|
|
},
|
|
{
|
|
"name": "ldap-plugin-with-claims-enrichment-and-client-provisioning",
|
|
"slug": "ldap-plugin-with-claims-enrichment-and-client-provisioning",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/ldap-plugin-with-claims-enrichment-and-client-provisioning/run-001/tier2-integration-check.json",
|
|
"notes": "75 dedicated LDAP plugin tests: claims enrichment, client provisioning, capability probing, DN parsing, credential store, TLS, resilience, security, metrics."
|
|
},
|
|
{
|
|
"name": "local-rbac-policy-fallback-with-break-glass-access",
|
|
"slug": "local-rbac-policy-fallback-with-break-glass-access",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/local-rbac-policy-fallback-with-break-glass-access/run-001/tier2-integration-check.json",
|
|
"notes": "File-based policy store, role inheritance, subject lifecycle, break-glass configuration, fallback mode transitions, Postgres-backed primary store."
|
|
},
|
|
{
|
|
"name": "multi-tenant-scope-based-authorization",
|
|
"slug": "multi-tenant-scope-based-authorization",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/multi-tenant-scope-based-authorization/run-001/tier2-integration-check.json",
|
|
"notes": "130+ tests: scope definitions, authorization policies, tenant header filter, tenant catalog, tenant repository. 103 abstractions + 27 server integration tests."
|
|
},
|
|
{
|
|
"name": "pack-rbac-roles-and-cli-profiles",
|
|
"slug": "pack-rbac-roles-and-cli-profiles",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/pack-rbac-roles-and-cli-profiles/run-001/tier2-integration-check.json",
|
|
"notes": "Pack scope definitions, AddPacksResourcePolicies, RequireScope/RequireAnyScope extensions, CLI profile configuration, per-profile token caching."
|
|
},
|
|
{
|
|
"name": "plugin-sdk-plugin-architecture",
|
|
"slug": "plugin-sdk-plugin-architecture",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/plugin-sdk-plugin-architecture/run-001/tier2-integration-check.json",
|
|
"notes": "32 SDK abstractions tests + plugin loader tests. Plugin contracts, registration context, credential audit, secret hasher, client metadata keys. 5 concrete registrars."
|
|
},
|
|
{
|
|
"name": "postgres-backend-store-prototype-for-authority-tokens",
|
|
"slug": "postgres-backend-store-prototype-for-authority-tokens",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/postgres-backend-store-prototype-for-authority-tokens/run-001/tier2-integration-check.json",
|
|
"notes": "75 persistence tests + adapter tests. Token CRUD, refresh token rotation, InMemory parity, session persistence, EF Core migrations, ID generation, clock integration."
|
|
},
|
|
{
|
|
"name": "rfc-3161-tsa-client-for-ci-cd-timestamping",
|
|
"slug": "rfc-3161-tsa-client-for-ci-cd-timestamping",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/rfc-3161-tsa-client-for-ci-cd-timestamping/run-001/tier2-integration-check.json",
|
|
"notes": "32 tests: ASN.1 encoding/decoding, token verification, provider registry with priority/health, response caching, abstraction contracts. CI/CD hooks documented as planned enhancements."
|
|
},
|
|
{
|
|
"name": "trust-root-and-certificate-chain-verification",
|
|
"slug": "trust-root-and-certificate-chain-verification",
|
|
"status": "passed",
|
|
"tier": "tier2d",
|
|
"evidence": "docs/qa/feature-checks/runs/authority/trust-root-and-certificate-chain-verification/run-001/tier2-integration-check.json",
|
|
"notes": "Token verifier with imprint/nonce mismatch detection, key rotation with JWKS continuity, RSA sign/verify roundtrip, KMS and file key sources, DSSE signing."
|
|
}
|
|
]
|
|
}
|