History / Authorization

docs(wiki): record release 0.5.0 Release-Notes.md: add the section of release 0.5.0 Roadmap.md: add the items of release 0.5.0 with pull requests 32 to 35 and the tag v0.5.0 Getting-Started.md: fetch the tag v0.5.0 Home.md: add the row of the time limits of the keychain storage of version 0.5.0 Authorization.md: mark the time limits timeout and prompt_timeout of the keychain storage as zig-sdk 0.5.0 Transport-Unix-Socket.md: describe the poll before each read on Windows, which sees a close of the peer that the driver loses

ChristianPresley committed Oct 8, 2026

docs(wiki): add the time limits of the keychain storage Authorization.md: describe the time limits timeout and prompt_timeout of the Secret Service backend, and mark them in the applies-to line as on main after 0.4.0.

ChristianPresley committed Oct 8, 2026

docs(wiki): record release 0.4.0 Authorization.md: add the section on private CAs and proxies (ca_bundle, proxy, Fetcher fields), the reload of the stored record before a refresh, and the section on one storage that more clients share Client-Guide.md: add the sections on HTTP proxies, request metadata (log_level, meta, error.InvalidMeta), notifications (scratch memory, inline_notifications) and errors and diagnostics (router failures, http_status), and the stdio exitStatus Concepts.md: say that the memory link does not obey the client time limits Deprecated-Features.md: add the row of RequestOptions.log_level Getting-Started.md: fetch the tag v0.4.0 Home.md: add the rows of the request options and the HTTP proxies of version 0.4.0, and make the Applies to line apply to each version Interoperability.md: add the scripted HTTP/2 peer with a dynamic HPACK table to the known gaps Limits-and-Security.md: add the limits of the HTTP client for each SSE event, the proxy section, the remembered resets of HTTP/2 and the security defaults of the proxy, ca_bundle, the router log and _meta Release-Notes.md: add the section of release 0.4.0 Roadmap.md: add the items of release 0.4.0 with pull requests 23 to 31 and the tag v0.4.0 Server-Guide.md: describe the listen acknowledgment before the first event and the lock of a listen stream on the memory link Threat-Model.md: add the rows of the client memory, the client router, the proxy, HTTP/2, the shared storage, the CA bundle, the stdio process and _meta, and update the gap of the storage lock Transport-Streamable-HTTP.md: add the limit for each SSE event, the warnings of the client, Diagnostics.http_status and the proxy section Transport-Unix-Socket.md: add the notifications of the client, inline notifications and the frames that the client cannot read Transport-WebSocket.md: add the notifications of the client, inline notifications, the frames that the client cannot read and the status of a refused upgrade Transport-gRPC.md: add the early responses, the streams and resets (stopWaits, CallStream, refused streams), the header blocks after a size error or a reset, and the remembered resets limit Transport-stdio.md: add the on_notification and userdata spawn options, the routed notifications, the frames that the client cannot read, exitStatus and the reap of a server that ends its output Transports.md: give the limits of the in-memory link for use in production

ChristianPresley committed Oct 8, 2026

docs(wiki): correct every page against the code of release 0.2.0 API-Reference.md: add the conformance matrix link and the manual start of docs.yml Apps-Extension.md: give the full error message of a hidden tool call Authorization-Server.md: set the reviewed date to 2026-09-30 and tell how an MCP server gets the verification keys Authorization.md: add the WebSocket authorization, the token_type check, the refusal codes of a refresh, the PS256 keys from PKCS#8 and the links to the authorization server, and correct the client_id statement and the users of ClientAuth Client-Guide.md: add the WebSocket and gRPC client transports, correct the HTTP connection model, add the TLS options and log_level, list the other typed methods, add WebSocket to the cache credential, update the Applies-to line Concepts.md: give the SDK versions on the Applies-to line, correct the sentence about the progress rate Conformance.md: name the 0.2.0 parts on the Applies-to line, correct the grpc-interop description and the push trigger Contributing.md: tell that commit-policy also checks the author and the committer, add the spec-matrix step, tell what the nightly wiki-lint job compares Deploy-Reverse-Proxy.md: correct the allowed_hosts rule and the nginx example, add the request timeout, the cancellation at a disconnect, DPoP, the rate limits behind a proxy and the WebSocket upgrade, update the Applies-to line Deprecated-Features.md: tell that the client registers dynamically by default, add the registration of the authorization server, the rate limit of log messages and the HTTP+SSE transport, update the Applies-to line Examples.md: name the 0.2.0 programs and modes on the Applies-to line, tell the gRPC tunnel, ports and defaults, add the file storage of client_cli, tell how to build consumer FAQ.md: name the 0.2.0 answers on the Applies-to line, add WebSocket, the D-Bus client and the new fixtures to the dependency answer Getting-Started.md: fetch the v0.2.0 tag in place of main, say that the fetch adds the dependency mcp, name the executable calc Glossary.md: add WebSocket to Transport, add Authorization server, DPoP, Keychain, Token storage, Tunnel, Typed binding and WebSocket, name the 0.2.0 terms on the Applies-to line Home.md: count five transports and link JSON Schema Support, Examples and Limits and Security Interoperability.md: remove the TLS 1.2 refusal claim from the OpenSSL row, add the 0.2.0 OpenSSL and std client checks, name grpc-js and the test fixtures as exceptions, correct the hybrid key exchange gap JSON-Schema-Support.md: name the regex errors of the validator and the limits.schema location, correct the required fields and the header field of derived schemas, update the Applies-to line Limits-and-Security.md: mark the limits that 0.2.0 does not apply, correct the client handshake limit, add the authorization server limits and the TLS cookie and option limits, update the Applies-to line Release-Notes.md: correct the milestones of 0.2.0 to M10 to M12, add tag links, the documentation site, the lint-docs and build step changes, the API breaks and the security fixes Resource-Templates.md: add the template and URI length limits, correct the "Resource not found" message, add the completion reference rules, update the Applies-to line Roadmap.md: mark M12 as done except the external TLS review, correct the milestones of release 0.2.0, add the open item of the limits that 0.2.0 does not apply Server-Guide.md: correct the default of mrtr, add the option cache, add WebSocket to principal(), add the logging capability to log, add the notify functions, update the Applies-to line Style-Guide-STE.md: give the real default paths of the linter, tell what STE-1.1 finds, exempt _Sidebar.md and _Footer.md from the page template TLS-and-Certificates.md: correct the default chain choice, the Kind values and the chain alerts, add the EKU alert, the TLS users of WebSocket and gRPC, the HelloRetryRequest cookie and the AEGIS and padding HTTPS test Threat-Model.md: replace a test name that does not exist, add the gRPC, TLS record and length rows, add the HTTP time limits and the JSON depth limit to the gaps, correct the Roadmap sentence Transport-Streamable-HTTP.md: add status 429, Mcp-Name for tasks, DPoP and auth_provider, remove the head timeout claim, update the Applies-to line Transport-Unix-Socket.md: add error.AccessControlFailed Transport-WebSocket.md: correct the reviewed date, add the example websocket_server Transport-gRPC.md: correct the error code of the frame limits, tell which errors end a tunnel call in the trailers, add the tunnel interop calls, update the Applies-to line Transport-stdio.md: correct the name of the shutdown flag of the cancel token, update the Applies-to line Transports.md: add the typed gRPC row, describe the typed service, describe the socket protection on POSIX and Windows and the private directory, update the Applies-to line

ChristianPresley committed Oct 1, 2026

Release 0.2.0: release notes, version markers and the closed roadmap items Release-Notes.md: add the section of release 0.2.0 Roadmap.md: mark the release of milestones M7 to M12 as done, record the internal TLS review and the open external review, and link pull request 10 Conformance.md: give the matrix numbers of release 0.2.0, correct the n/a example, and add the steps of the authorization server fixture Home.md: name version 0.2.0 in the status table and link the authorization and TLS pages All other pages: replace the release after 0.1.0 with version 0.2.0 and set the sdk marker to 0.2.0

ChristianPresley committed Oct 1, 2026

Authorization: refresh tokens and token storage in the keychain Authorization.md: add the sections on refresh tokens and on the token storage with the keychain backends, and name the DPoP scheme of the Authorization header Threat-Model.md: add the token storage threats and the open items of the Secret Service transfer and the lock between processes Roadmap.md: mark the token storage as done in pull request 16 Home.md: add refresh tokens and the token storage to the status table Examples.md: add the --oauth mode of client_cli Bibliography.md: regenerate with the keychain sources Dictionary.md: regenerate

ChristianPresley committed Oct 1, 2026

Authorization Server: add the page and the authorization server rows of the other pages Authorization-Server.md: add the page of the embeddable authorization server with its options, security notes, conformance and limits _Sidebar.md: add Authorization Server Authorization.md: link the authorization server and its conformance result Conformance.md: add the results and the steps of the two authorization server scenarios Roadmap.md: mark the authorization server as done in pull request 15 Examples.md: add the authorization_server example Home.md: add the authorization server to the status table Interoperability.md: add the authorization command of the conformance suite Threat-Model.md: add the authorization server threats Bibliography.md: regenerate with RFC 8252 and RFC 9068

ChristianPresley committed Oct 1, 2026

docs(wiki): describe DPoP and workload identity federation and correct the conformance results Authorization.md: the DPoP and workload identity extensions, the DPoP policy of the resource server, the workload JWT validator and the conformance result Conformance.md: all six extension scenarios pass, the three pending server scenarios, the eight wire-schema-valid failures and the gated unscored runs in CI Tasks-Extension.md: wire-schema-valid fails in the eight scenarios that create a task, and CI permits only this check Interoperability.md: the unscored scenarios run one at a time Threat-Model.md: DPoP and workload identity rows, the claim overflow row and the DPoP token default Roadmap.md: milestone M12 with the later items of the plan, DPoP and workload identity done, and no known limit for them Home.md: the DPoP and workload identity row Bibliography.md: copy of the generated bibliography with RFC 9449, RFC 7638 and the two drafts Dictionary.md: copy of the generated dictionary with DPoP and SPIFFE

ChristianPresley committed Oct 1, 2026

docs(wiki): describe the issuer-bound credentials, URL checks, scope hierarchies and new threat rows Authorization.md: describe pre_registered as a list of issuer-bound credentials with an example, the client ID metadata document URL and redirect URI checks, application_type, allow_http, lastFailure, the case rules for resource and audience, the gRPC principal, the principal binding of requestState and scope_hierarchy Threat-Model.md: add the defaults for the client cache and the request timeout, and the rows for header values, cancellation, principal binding, URL checks, sampling and form checks, issuer binding, endpoint security, scope hierarchies and the Unix socket path

ChristianPresley committed Sep 30, 2026

docs(wiki): describe the client credentials and enterprise-managed authorization extensions Authorization.md: add the auth_provider option, the two authorization extensions, the JWT signing keys, the ID-JAG validation and the new JWT algorithms

ChristianPresley committed Sep 30, 2026

docs(wiki): add the transport, resource template, proxy and release notes pages and pass lint-docs --strict Transport-stdio.md: add the stdio framing, the server loop, the client options and the process management Transport-Streamable-HTTP.md: add the HTTP server options, the status table, header mirroring, the client options and the security defaults Resource-Templates.md: add the registration, the supported RFC 6570 syntax, the match rules, the listing and the completion of templates Deploy-Reverse-Proxy.md: add the Host and Origin settings, SSE buffering, time limits and examples for nginx and Caddy Release-Notes.md: add the notes of 0.1.0 from the changelog Transports.md: keep an overview with links to the page of each transport _Sidebar.md: link the new pages and rename the writing group Home.md: link the new pages Glossary.md: add the terms of the new pages Examples.md: add the run step of the build system Interoperability.md: add the stdio gap of the conformance suite FAQ.md: add the reverse proxy question Limits-and-Security.md: correct the stdio line limit and the URI template limits to match the code, and use the active voice Style-Guide-STE.md: copy the complete profile with every rule id, the linter options and the dictionary files Dictionary.md: regenerate from the complete word lists Authorization.md: use the active voice and no -ing forms Client-Guide.md: use US spelling, the active voice, no semicolon and no phrasal verb Concepts.md: use the active voice and name the gRPC binding as present Contributing.md: use US spelling and the active voice Deprecated-Features.md: use the active voice JSON-Schema-Support.md: use the active voice and quote the document title Server-Guide.md: use US spelling, the active voice and no phrasal verb TLS-and-Certificates.md: use the active voice and name TLS resumption tickets Tasks-Extension.md: use US spelling and the active voice Threat-Model.md: write the controls in the active voice Transport-gRPC.md: use US spelling, the active voice, code spans for frame names, and cite reference 6 Versioning.md: use US spelling and the active voice _Footer.md: use the active voice

ChristianPresley committed Sep 30, 2026

docs(wiki): add the limits, deprecated features, interoperability and FAQ pages for 0.1.0 Limits-and-Security.md: add every limit with its default and overflow behaviour, and the security defaults Deprecated-Features.md: add the deprecated features behind options and what the SDK never provides Interoperability.md: add the foreign peers each test runs against and the known gaps FAQ.md: add the first questions _Sidebar.md: link the new pages Authorization.md: set the version markers to 0.1.0 Client-Guide.md: set the version markers to 0.1.0 Concepts.md: set the version markers to 0.1.0 Conformance.md: set the version markers to 0.1.0 Contributing.md: set the version markers to 0.1.0 Examples.md: set the version markers to 0.1.0 Getting-Started.md: set the version markers to 0.1.0 Glossary.md: set the version markers to 0.1.0 Home.md: set the version markers to 0.1.0 JSON-Schema-Support.md: set the version markers to 0.1.0 Roadmap.md: set the version markers to 0.1.0 Server-Guide.md: set the version markers to 0.1.0 Style-Guide-STE.md: set the version markers to 0.1.0 TLS-and-Certificates.md: set the version markers to 0.1.0 Tasks-Extension.md: set the version markers to 0.1.0 Threat-Model.md: set the version markers to 0.1.0 Transport-gRPC.md: set the version markers to 0.1.0 Transports.md: set the version markers to 0.1.0 Versioning.md: set the version markers to 0.1.0

ChristianPresley committed Sep 30, 2026

docs(wiki): split a long sentence on the authorization page Authorization.md: the JWT verifier paragraph uses three short sentences.

ChristianPresley committed Sep 30, 2026

docs(wiki): describe the resource server helpers Authorization.md: the section that protects a server with `ResourceServer` and `JwtVerifier`, the challenge rules and two more references. Home.md: mark the resource server helpers as done. Roadmap.md: mark milestone M5 as done.

ChristianPresley committed Sep 30, 2026

docs(wiki): add the guide pages, the generated bibliography and the dictionary Authorization.md: the OAuth 2.1 client, what it does on a challenge, and the conformance result. Bibliography.md: every source with a stable key, generated by zig build gen-bibliography. Client-Guide.md: the client library, its transports, request options and hooks. Concepts.md: the stateless protocol model of revision 2026-07-28. Conformance.md: the official suite, the results, the steps to run it and the tier statement. Contributing.md: the commit rules, the setup steps and the wiki rules. Dictionary.md: the project dictionary, generated by zig build gen-dictionary. Getting-Started.md: how to add the SDK to a project and run the first server and client. Glossary.md: the terms the wiki uses. Home.md: the landing page with the status table and the map of the wiki. JSON-Schema-Support.md: the supported and rejected keywords, the limits and derived schemas. Roadmap.md: the milestones and their state. Server-Guide.md: the server library, handlers, the request context, multi round-trip requests and errors. Style-Guide-STE.md: the project profile of ASD-STE100 with the page template. TLS-and-Certificates.md: the TLS 1.3 server, its features, the HTTPS steps and the tests. Transports.md: stdio, Streamable HTTP, HTTPS, the in-memory link and the planned gRPC binding. Versioning.md: the version rules and the steps to move to a new MCP revision. _Footer.md: the license and style note under every page. _Sidebar.md: the page list.

ChristianPresley committed Sep 30, 2026