Consolidate the wiki: canonical Coding Standards, merged Architecture, split Provider Setup Restructure the wiki into one coherent, audience-grouped set with a single home for each fact. - New Coding-Standards page: the one canonical statement of the architecture, comment/documentation (#864), and object-oriented rules; the repo's CLAUDE.md and CONTRIBUTING.md now point here instead of restating them. - Merged the two stale, mutually-overlapping Architecture pages into one, re-based on the current module-DAG reality (the old pages claimed the module split was "not pursued" and that no IPluginServiceRegistrator existed — both were wrong and contradicted docs/ARCHITECTURE.md). Cites modules and types, never file:line, so it cannot drift on a move again. - Split Provider-Setup (1172 lines, ~73% not provider-specific) into Provider Setup (recipes) + a new Hardening & Options Reference; folded the security- control narrative into the Security Model. Every moved section left a pointer. - Merged Release-Policy + Release-QA-Checklist into Releasing (renamed the per-release ladder to "release promotion ladder" to end the Beta-rung name collision); merged OpenSSF-Best-Practices + Maturity-Map into Security & Maturity Self-Assessment. Old slugs kept as redirect stubs. - Rebuilt the sidebar into four audience groups (Getting started / How it works / Security / Standards & process). Fixed the broken anchors, corrected the beta publish-trigger to the daily scheduler (it is not "every merge"), de-referenced the design records to module/type names, and trimmed Home's README duplication.

iderex committed Jul 20, 2026

Record the minimum signing-key strength floor as Met (#733)

iderex committed Jul 20, 2026

Reflect the OIDC SSRF parity landing (#755) in the security docs The Security-Conformance V12 row flips from Met(avatar)/Partial(OIDC) to Met (the shared hardened transport in Api/Net/SsoHttp now guards discovery/JWKS/token/userinfo), and the #755 accepted-residual is removed; the Security-Model SSRF section is broadened from avatar-only to all outbound fetches with the shared connect-time guard.

iderex committed Jul 20, 2026

Document SSO-only login: runbook, security summary, lockout recovery The mode shipped (#665) but the wiki still called it not implemented, and the settings page points at a Provider Setup runbook that did not exist. - Provider Setup: full operator runbook (enforcement semantics, break-glass guard, the four elevation-gated endpoints, server-managed state, recovery) - Security Model: enforcement-property summary and the audited transitions - Troubleshooting: locked-out recovery entry (break-glass, config-XML edit) - SSO-Only Login Design: status corrected to implemented, kept as the record - Home: feature listed under what it does today

iderex committed Jul 19, 2026

Migrate design, process, and provider docs from the repo into the wiki Add wiki pages for the per-provider setup guides, the delivery-pipeline threat model, the release/rollback/review-gate/QA process docs, the DORA delivery metrics, the OpenSSF best-practices assessment, the single-logout and SSO-only-login design notes, and an architecture-internals code map. Retarget every internal link: cross-doc references now point at wiki pages, references to files that stay in the repo point at full github blob URLs, and provider screenshots point at raw.githubusercontent URLs. Add a grouped navigation to Home (user docs / architecture & security / process & release / design records), cross-link Login-Flow and Architecture with the new Architecture-Internals map, and cross-link Security-Model with Threat-Model.

iderex committed Jul 19, 2026

Document issuer-binding, secrets-at-rest, and the legacy-link upgrade path Mirror the current providers.md security posture onto the wiki: - Security-Model: issuer-bound OpenID links (repointing protection), secrets encrypted at rest (ssoenc envelope + downgrade note), and the admin-account exemption for the legacy username-keyed link migration. - Migrating-from-9p4: issuer-binding behavior and the encrypted-secret rollback caveat. - Troubleshooting: the post-upgrade gated legacy-link case (403 / fresh account). Closes #371.

iderex committed Jul 18, 2026

Document the login browser binding, SAML response-binding options, and per-client in-flight capacity Merged since the last wiki pass: the SAML browser-binding cookie (#415) alongside the existing OpenID one, and the per-client share of the in-flight state stores (#327). The Security Model page now covers both binding cookies, the opt-in ValidateRecipient/ValidateInResponseTo checks, and the capacity model; Troubleshooting gains the matching failure modes (HTTP-only deployments, cross-browser callbacks, lost InResponseTo correlation, IdP-initiated logins with ValidateInResponseTo on).

iderex committed Jul 17, 2026

Document provider-disable semantics on the grant paths

iderex committed Jul 16, 2026

Gate the legacy-link migration note behind AllowExistingAccountLink Mirrors the #354 fix into the wiki: the Security Model page gains an upgrade note (the legacy username-keyed migration now honors the AllowExistingAccountLink opt-in, with break-glass and the takeover-window caveat), and the 9p4 migration page's now-false 'migrates automatically, no admin action' line is corrected to point at the flag and the runbook.

shippingToken committed Jul 15, 2026

Document the auth-page CSP and the rate-limiter keying/notice; drop the stale pre-alpha label The Security Model page did not mention the nonce-based Content-Security-Policy the auth page has carried since the response-hardening work, even though the Login Flow page already points at the Response hardening section for it. Describe the policy and what it denies. The rate-limiting section now also covers two behaviors that landed after the last wiki pass: IPv4-in-IPv6 transition sources (NAT64 well-known prefix, 6to4, IPv4-compatible) are keyed on their embedded IPv4 rather than the shared /64, and throttling engagement is summarized in a bounded log notice (one line per minute, count only) so an operator can spot sustained abuse or a pooled-proxy misconfiguration. The migration page still called the project pre-alpha; the maturity ladder names this stage In-Development, so align the warning with the Roadmap wording.

iderex committed Jul 14, 2026

Document the PKCE downgrade check, SAML size cap, and state-store bound

iderex committed Jul 13, 2026

Document the hardening merged since the last wiki pass Security Model: RFC 9207 authorization-response issuer check (with the DoNotValidateResponseIssuer escape hatch), the avatar raster content-type allow-list (SVG refused), replay-cache enforcement on the account-linking callback, and SSO revocation via POST /sso/Unregister. Troubleshooting: the 'SSO response validation failed' cause and its per-provider relax.

iderex committed Jul 13, 2026

Security Model: document optional rate limiting and write-only client secret

rekamer committed Jul 12, 2026

Document the OpenID id_token validation The Security Model page now describes the fail-closed id_token checks (JWKS signature under an asymmetric-only allowlist, issuer, audience/azp, lifetime, at_hash), and Troubleshooting gains the matching failure entry (HS256-signed tokens, clock drift, issuer mismatch, missing JWKS). Refs iderex/jellyfin-plugin-sso#134

iderex committed Jul 12, 2026

Reflect yesterday's SAML/OIDC hardening in the security docs Security-Model gained the DTD/XXE-billion-laughs prohibition (PR #121), the OpenID state provider-binding and single-use replay guard (PR #56), the defensive response headers on the rendered auth page (PR #124), and the structured audit trail (PR #132) - none were reflected here yet. Troubleshooting's OpenID state lifetime was stale: it said about a minute, but PR #56 raised it to 15 minutes to accommodate provider-side MFA/consent.

iderex committed Jul 12, 2026

Initial wiki: Home, Installation, Security Model, Troubleshooting

rekamer committed Jul 11, 2026