Replace the typographic dashes on every page
612 dashes across 22 of the 30 pages. No page ends a line with a
space afterwards, and 566 dashes that would have started a Markdown list are
escaped so the list does not appear.
A wiki has no pull request and no gate, so the counts before and after are the
evidence: the run is recorded in iderex/operations#861.
Part of the fleet-wide pass in iderex/operations#860.
Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Consolidate the Provider-Setup option sections into one options pointer
Provider-Setup carried 19 'Moved: see …' redirect stubs plus two summary sections, each pointing at per-provider options already documented in Hardening & Options Reference / Security Model — the scattered-reference pattern we are consolidating away. Fold all of them into one 'Configuring a provider — options and hardening' section that keeps the basic RBAC config example (whose single home is this setup page) and points to the two single homes. The page is now the per-provider setup walkthroughs plus that one pointer. No dead internal anchors; the option content is unchanged in its homes.
Signed-off-by: iderex <30603423+iderex@users.noreply.github.com>
Document permission-role mapping; scope the scalar policy fields (#827)
The full boolean PermissionKind surface has been claim-mappable since #164
(EnablePermissionRoles + PermissionRoleMappings) but was undocumented, so the
most-upvoted upstream ask (9p4#295 'User Policy from Claims', 9p4#95 'User
Options via Roles/Groups') read as unimplemented. Adds a Hardening & Options
Reference section covering the config shape, the deny-by-default/authoritative
semantics, the PermissionKind names, the dedicated-permission exclusions, and
save validation, plus a Provider-Setup pointer. Field names verified against
PluginConfiguration.cs + PermissionRolePolicy.cs on main. The remaining scalar
fields (max bitrate, max sessions) that are not PermissionKinds stay tracked in
#827.
Add Dex and Zitadel provider guides; document the beta-only channel (#932, #937, #954, #956)
Provider Setup gains Zitadel (object-map role claim urn:zitadel:iam:org:project:roles
with RoleClaimIsObjectMap, projectRoleAssertion + idTokenRoleAssertion both required,
role grants per user) and Dex (login round-trip; the built-in password database carries
no groups, so RBAC needs an upstream connector; no preferred_username - the username
comes from the name claim). Both recipes mirror the plugin's automated end-to-end
harnesses, so every setting is verified nightly.
Beta-only sweep (#954/#956): Installation and Migrating-from-9p4 point at the beta
repository URL only (the stable manifest is emptied until the first stable release);
Releasing and Rollback carry a status note and describe the JF12 leg publishing from
main (the 4.2 branch is retired); the catalog name is Community SSO for Jellyfin.
Consolidate the wiki: canonical Coding Standards, merged Architecture, split Provider Setup
Restructure the wiki into one coherent, audience-grouped set with a single home
for each fact.
- New Coding-Standards page: the one canonical statement of the architecture,
comment/documentation (#864), and object-oriented rules; the repo's CLAUDE.md
and CONTRIBUTING.md now point here instead of restating them.
- Merged the two stale, mutually-overlapping Architecture pages into one, re-based
on the current module-DAG reality (the old pages claimed the module split was
"not pursued" and that no IPluginServiceRegistrator existed — both were wrong
and contradicted docs/ARCHITECTURE.md). Cites modules and types, never
file:line, so it cannot drift on a move again.
- Split Provider-Setup (1172 lines, ~73% not provider-specific) into Provider
Setup (recipes) + a new Hardening & Options Reference; folded the security-
control narrative into the Security Model. Every moved section left a pointer.
- Merged Release-Policy + Release-QA-Checklist into Releasing (renamed the
per-release ladder to "release promotion ladder" to end the Beta-rung name
collision); merged OpenSSF-Best-Practices + Maturity-Map into Security &
Maturity Self-Assessment. Old slugs kept as redirect stubs.
- Rebuilt the sidebar into four audience groups (Getting started / How it works /
Security / Standards & process). Fixed the broken anchors, corrected the beta
publish-trigger to the daily scheduler (it is not "every merge"), de-referenced
the design records to module/type names, and trimmed Home's README duplication.
Document the SAML metadata-import endpoint (#735)
Note the OIDC form now shows and copies the redirect URI (#724)
Document the parental-rating-by-role mapping (#736)
Document the OIDC step-up / MFA options (#757)
Document the provision-new-users-pending-approval workflow (#737)
Document SSO-only login: runbook, security summary, lockout recovery
The mode shipped (#665) but the wiki still called it not implemented, and
the settings page points at a Provider Setup runbook that did not exist.
- Provider Setup: full operator runbook (enforcement semantics, break-glass
guard, the four elevation-gated endpoints, server-managed state, recovery)
- Security Model: enforcement-property summary and the audited transitions
- Troubleshooting: locked-out recovery entry (break-glass, config-XML edit)
- SSO-Only Login Design: status corrected to implemented, kept as the record
- Home: feature listed under what it does today
Refresh wiki to Alpha stage, packaged-release install, and three-part versioning
- Home/Installation/Migrating: replace the In-Development banner with the Alpha
maturity; document the plugin-catalog install (stable/beta manifest URLs) and the
multi-target net9.0/net10.0 build for Jellyfin 10.11 and 12.0; drop the
build-from-source-only / no-manifest wording now that the channels are live.
- Release-Policy/OpenSSF: describe the three-part X.Y.Z scheme, with the channel and
Jellyfin generation as a tag/release-name suffix and Z covering both bug-fix and
security, instead of the retired four-part X.Y.Z.W (W=security).
- Provider-Setup: fix "recieve" typo.
- OpenSSF/Release-Policy/Release-QA-Checklist/Rollback/Threat-Model: use the wiki page
name as link text for docs that moved out of the repo (Review Gate, Rollback,
Release QA Checklist, Provider Setup, Architecture Internals, Threat Model).
Migrate design, process, and provider docs from the repo into the wiki
Add wiki pages for the per-provider setup guides, the delivery-pipeline
threat model, the release/rollback/review-gate/QA process docs, the DORA
delivery metrics, the OpenSSF best-practices assessment, the single-logout
and SSO-only-login design notes, and an architecture-internals code map.
Retarget every internal link: cross-doc references now point at wiki pages,
references to files that stay in the repo point at full github blob URLs,
and provider screenshots point at raw.githubusercontent URLs. Add a grouped
navigation to Home (user docs / architecture & security / process & release
/ design records), cross-link Login-Flow and Architecture with the new
Architecture-Internals map, and cross-link Security-Model with Threat-Model.