Consolidate the wiki: canonical Coding Standards, merged Architecture, split Provider Setup
Restructure the wiki into one coherent, audience-grouped set with a single home
for each fact.
- New Coding-Standards page: the one canonical statement of the architecture,
comment/documentation (#864), and object-oriented rules; the repo's CLAUDE.md
and CONTRIBUTING.md now point here instead of restating them.
- Merged the two stale, mutually-overlapping Architecture pages into one, re-based
on the current module-DAG reality (the old pages claimed the module split was
"not pursued" and that no IPluginServiceRegistrator existed — both were wrong
and contradicted docs/ARCHITECTURE.md). Cites modules and types, never
file:line, so it cannot drift on a move again.
- Split Provider-Setup (1172 lines, ~73% not provider-specific) into Provider
Setup (recipes) + a new Hardening & Options Reference; folded the security-
control narrative into the Security Model. Every moved section left a pointer.
- Merged Release-Policy + Release-QA-Checklist into Releasing (renamed the
per-release ladder to "release promotion ladder" to end the Beta-rung name
collision); merged OpenSSF-Best-Practices + Maturity-Map into Security &
Maturity Self-Assessment. Old slugs kept as redirect stubs.
- Rebuilt the sidebar into four audience groups (Getting started / How it works /
Security / Standards & process). Fixed the broken anchors, corrected the beta
publish-trigger to the daily scheduler (it is not "every merge"), de-referenced
the design records to module/type names, and trimmed Home's README duplication.
Advance maturity to Beta and add the role-gate denial troubleshooting entry
Flip Home/Roadmap/Migrating from Alpha to Beta for the 4.3.0 release: drop the
Alpha for-testing-only warning block for a concise Beta status, move the ladder
marker to Beta, and soften the production-use wording to Beta-appropriate. Add a
Troubleshooting entry mapping the reworded role-gate denial message (#668).
Document SSO-only login: runbook, security summary, lockout recovery
The mode shipped (#665) but the wiki still called it not implemented, and
the settings page points at a Provider Setup runbook that did not exist.
- Provider Setup: full operator runbook (enforcement semantics, break-glass
guard, the four elevation-gated endpoints, server-managed state, recovery)
- Security Model: enforcement-property summary and the audited transitions
- Troubleshooting: locked-out recovery entry (break-glass, config-XML edit)
- SSO-Only Login Design: status corrected to implemented, kept as the record
- Home: feature listed under what it does today
Migrate design, process, and provider docs from the repo into the wiki
Add wiki pages for the per-provider setup guides, the delivery-pipeline
threat model, the release/rollback/review-gate/QA process docs, the DORA
delivery metrics, the OpenSSF best-practices assessment, the single-logout
and SSO-only-login design notes, and an architecture-internals code map.
Retarget every internal link: cross-doc references now point at wiki pages,
references to files that stay in the repo point at full github blob URLs,
and provider screenshots point at raw.githubusercontent URLs. Add a grouped
navigation to Home (user docs / architecture & security / process & release
/ design records), cross-link Login-Flow and Architecture with the new
Architecture-Internals map, and cross-link Security-Model with Threat-Model.
Document issuer-binding, secrets-at-rest, and the legacy-link upgrade path
Mirror the current providers.md security posture onto the wiki:
- Security-Model: issuer-bound OpenID links (repointing protection), secrets
encrypted at rest (ssoenc envelope + downgrade note), and the admin-account
exemption for the legacy username-keyed link migration.
- Migrating-from-9p4: issuer-binding behavior and the encrypted-secret rollback
caveat.
- Troubleshooting: the post-upgrade gated legacy-link case (403 / fresh account).
Closes #371.
Document the login browser binding, SAML response-binding options, and per-client in-flight capacity
Merged since the last wiki pass: the SAML browser-binding cookie (#415) alongside the existing OpenID one, and the per-client share of the in-flight state stores (#327). The Security Model page now covers both binding cookies, the opt-in ValidateRecipient/ValidateInResponseTo checks, and the capacity model; Troubleshooting gains the matching failure modes (HTTP-only deployments, cross-browser callbacks, lost InResponseTo correlation, IdP-initiated logins with ValidateInResponseTo on).
Document the PKCE downgrade check, SAML size cap, and state-store bound
Document the hardening merged since the last wiki pass
Security Model: RFC 9207 authorization-response issuer check (with the
DoNotValidateResponseIssuer escape hatch), the avatar raster content-type
allow-list (SVG refused), replay-cache enforcement on the account-linking
callback, and SSO revocation via POST /sso/Unregister. Troubleshooting:
the 'SSO response validation failed' cause and its per-provider relax.
Document the OpenID id_token validation
The Security Model page now describes the fail-closed id_token checks
(JWKS signature under an asymmetric-only allowlist, issuer, audience/azp,
lifetime, at_hash), and Troubleshooting gains the matching failure entry
(HS256-signed tokens, clock drift, issuer mismatch, missing JWKS).
Refs iderex/jellyfin-plugin-sso#134
Reflect yesterday's SAML/OIDC hardening in the security docs
Security-Model gained the DTD/XXE-billion-laughs prohibition (PR #121),
the OpenID state provider-binding and single-use replay guard (PR #56),
the defensive response headers on the rendered auth page (PR #124), and
the structured audit trail (PR #132) - none were reflected here yet.
Troubleshooting's OpenID state lifetime was stale: it said about a
minute, but PR #56 raised it to 15 minutes to accommodate provider-side
MFA/consent.
Initial wiki: Home, Installation, Security Model, Troubleshooting