Repository navigation

Feat/appauth - #70

Merged

grokify merged 40 commits into

mainfrom

feat/appauth

Oct 28, 2026

Merged

Feat/appauth#70
grokify merged 40 commits into
mainfrom
feat/appauth

Commits on Oct 28, 2026
- docs(specs): add application authentication spec (INIT-SYSTEMFORGE-014)
  
  grokify
  and
  claude
  committed
  8fe4bc5
- docs(specs): extend service principals into service accounts
  
  grokify
  and
  claude
  committed
  59af49e
- fix(relyingparty): answer a cross-origin session write with 403
  
  grokify
  and
  claude
  committed
  662ffaa
- feat(appauth): parse the application's DPoP key
  
  grokify
  and
  claude
  committed
  b2ab0a6
- feat(appauth): add sign-in configuration with labelled validation
  
  grokify
  and
  claude
  committed
  d4f1f61
- feat(appauth): assemble the relying party for an application
  
  grokify
  and
  claude
  committed
  abd85d8
- docs(specs): record that relyingparty already checks cookie writes
  
  grokify
  and
  claude
  committed
  cfc1e1a
- feat(principal): create service principals inside a caller's transaction
  
  grokify
  and
  claude
  committed
  aca6b61
- feat(approle): let service_account memberships hold application roles
  
  grokify
  and
  claude
  committed
  7e1535f
- feat(serviceaccount): add service accounts in an organization
  
  grokify
  and
  claude
  committed
  3f236a1
- feat(systemauth): add JWT-bearer key storage over service account keys
  
  grokify
  and
  claude
  committed
  29aaffa
- test(relyingparty): add a conformance suite for principal stores
  
  grokify
  and
  claude
  committed
  e79798a
- feat(pgstore): add a Postgres principal store on sf_rp_principals
  
  grokify
  and
  claude
  committed
  6708140
- test(appauth): cover other clients and calls to SystemAuth end to end
  
  grokify
  and
  claude
  committed
  51647ea
- feat(systemauth): register the JWT-bearer grant behind oauth.jwt_bearer
  
  grokify
  and
  claude
  committed
  78fc8ac
- docs: add the authenticating an application guide
  
  grokify
  and
  claude
  committed
  86cfadf
- feat(relyingparty): accept service accounts on their first request
  
  grokify
  and
  claude
  committed
  6a466d9
- feat(systemauth): issue JWT-bearer tokens to the service account
  
  grokify
  and
  claude
  committed
  7b154a2
- test(systemauth): end-to-end tests for the JWT-bearer grant
  
  grokify
  and
  claude
  committed
  9df9951
- feat(serviceclient): call APIs as a service account
  
  grokify
  and
  claude
  committed
  425235d
- Merge branch 'feat/service-accounts' into feat/appauth
  grokify
  committed
  dc586c0
- feat(appauth): accept the service-account client with ServiceAccounts
  
  grokify
  and
  claude
  committed
  d4a8e8b
- feat(serviceaccountcmd): manage service accounts from the command line
  
  grokify
  and
  claude
  committed
  6168a12
- test(serviceaccountcmd): set up a service account and call an application
  
  grokify
  and
  claude
  committed
  633812d
- docs: rewrite the service accounts page as a walkthrough
  
  grokify
  and
  claude
  committed
  4aa14ce
- docs(release): add v0.26.0 release notes and changelog
  
  grokify
  and
  claude
  committed
  2d83920
- docs(api-keys): shorten the sample key in the usage example
  
  grokify
  and
  claude
  committed
  60e437f
- docs: use the sf prefix in API key and marketplace examples
  
  grokify
  and
  claude
  committed
  016ae55
- docs(release): list the API key and prefix docs fixes in v0.26.0
  
  grokify
  and
  claude
  committed
  cda0a6e
- feat(systemauth): sign codes and refresh tokens with a configured HMAC secret
  
  grokify
  and
  claude
  committed
  54f81f9
- test(systemauth): codes and refresh tokens across restarts and rotation
  
  grokify
  and
  claude
  committed
  8f67e3d
- docs: describe the token HMAC secret and its rotation
  
  grokify
  and
  claude
  committed
  ea624df
- docs(release): add the token HMAC secret to v0.26.0
  
  grokify
  and
  claude
  committed
  53be440
- fix(principal): keep a post-commit sync failure out of the rollback
  
  grokify
  and
  claude
  committed
  0155f8e
- fix(relyingparty): refuse a service token whose principal is not a service
  
  grokify
  and
  claude
  committed
  e002fce
- fix(serviceaccount): end current tokens when any usable key is revoked
  
  grokify
  and
  claude
  committed
  715b955
- fix(systemauth): offer only accepted durations as JWT-bearer examples
  
  grokify
  and
  claude
  committed
  d0c99b5
- test(serviceaccountcmd): delete an account that has been issued tokens
  
  grokify
  and
  claude
  committed
  e57c79d
- docs: correct service-account roles, revocation and proof keys
  
  grokify
  and
  claude
  committed
  0d370f3
- docs(release): note the 403 change and shared stores in v0.26.0
  
  grokify
  and
  claude
  committed
  c1dc057

Commits

Commits on Oct 28, 2026