Consolidate the wiki: canonical Coding Standards, merged Architecture, split Provider Setup
Restructure the wiki into one coherent, audience-grouped set with a single home
for each fact.
- New Coding-Standards page: the one canonical statement of the architecture,
comment/documentation (#864), and object-oriented rules; the repo's CLAUDE.md
and CONTRIBUTING.md now point here instead of restating them.
- Merged the two stale, mutually-overlapping Architecture pages into one, re-based
on the current module-DAG reality (the old pages claimed the module split was
"not pursued" and that no IPluginServiceRegistrator existed — both were wrong
and contradicted docs/ARCHITECTURE.md). Cites modules and types, never
file:line, so it cannot drift on a move again.
- Split Provider-Setup (1172 lines, ~73% not provider-specific) into Provider
Setup (recipes) + a new Hardening & Options Reference; folded the security-
control narrative into the Security Model. Every moved section left a pointer.
- Merged Release-Policy + Release-QA-Checklist into Releasing (renamed the
per-release ladder to "release promotion ladder" to end the Beta-rung name
collision); merged OpenSSF-Best-Practices + Maturity-Map into Security &
Maturity Self-Assessment. Old slugs kept as redirect stubs.
- Rebuilt the sidebar into four audience groups (Getting started / How it works /
Security / Standards & process). Fixed the broken anchors, corrected the beta
publish-trigger to the daily scheduler (it is not "every merge"), de-referenced
the design records to module/type names, and trimmed Home's README duplication.
e8d2934
Document the SAML metadata-import endpoint (#735)
5664f06
Note the OIDC form now shows and copies the redirect URI (#724)
2999339
Document the parental-rating-by-role mapping (#736)
cd1926e
Document the OIDC step-up / MFA options (#757)
2aeb6ae
Document the provision-new-users-pending-approval workflow (#737)
d651ec2
Record the minimum signing-key strength floor as Met (#733)
5d4f562
Reflect the OIDC SSRF parity landing (#755) in the security docs
The Security-Conformance V12 row flips from Met(avatar)/Partial(OIDC) to Met (the shared hardened transport in Api/Net/SsoHttp now guards discovery/JWKS/token/userinfo), and the #755 accepted-residual is removed; the Security-Model SSRF section is broadened from avatar-only to all outbound fetches with the shared connect-time guard.
eea6e33
Publish the ASVS 5.0 + RFC 9700 security conformance self-assessment [#734]
New Security-Conformance wiki page: maps the RP authentication surface to OWASP ASVS 5.0 (V1 output/CSP, V6 auth incl. id_token + SAML XSW resistance, V7 session/revocation, V8 authz/last-admin, V11 crypto, V12 SSRF, brute-force) and the RFC 9700 OAuth BCP (PKCE-S256, exact redirect-URI, RFC 9207 iss/mix-up, no implicit/hybrid/ROPC; DPoP/JARM/PAR N-A-by-role justified), each row Met/Partial/N-A with a source-file citation. Accepted-residuals section records the min-key-strength floor (#733) and discovery/JWKS SSRF parity (#755) as open with reasoned risk, header completeness as met, and #708 as fixed. Framed as a maintainer self-assessment, no certification. Linked from Home and the sidebar.
889a1eb
Refresh the Architecture-Internals file paths after the module refactors [#823]
The module migration (#777) and its #807 kernel-dissolution finale moved several types out of the flat Api root: SSOController -> Api/Http, VerifiedIdentity -> Api/Identity, LoginOutcome -> Api/Session, and Saml.cs split into SamlResponse.cs (parser core) + SamlAuthnRequest.cs. Update every stale file path on the page (the flow trees, the outcome section, the extraction note, and the What-lives-where table) and refresh the controller line count.
cca5acb
Add an honest Silver/Gold/OSPS maturity map [#749]
New Maturity-Map wiki page: Met/Planned/Structurally-N-A buckets against OpenSSF Silver, Gold and OSPS Baseline. States prominently that review is single-maintainer + AI-assisted and the CODEOWNERS accounts are the maintainer team, not independent auditors; dispositions Gold bus_factor, contributors_unassociated, two_person_review and OSPS-QA-07.01/AC-03.01 as not-met-by-design with named compensating controls. Linked from Home and the sidebar.
695546d
Scope the two ABI lines separately for RC [#743]
Add section 9: the 4.x/JF10.11 line reaches RC now on its 10.11 live gate; the 5.0/JF12 line has a separate RC gate with a deferred live-validation trigger (run a JF12 E2E variant when a JF12 RC/GA server exists, watching the .NET 10 crypto-assembly exclusion and legacy-auth login #136); until then the JF12 beta is labelled unvalidated-against-live.
1055f1b
Reword to first-person voice [#721]
b60e3ba
Add the user-facing polish gate to the Beta-to-RC list [#753]
The RC gate now includes the user-facing docs/marketing definition of done, tracked item by item in the #822 meta-issue; the promotion-evidence paragraph names its artifact (the checked-off polish list).
b66baa5
Publish the native-OIDC coexistence stance [#721]
New Native-OIDC-Coexistence page: upstream watch (jellyfin#17271 open, 13.0 at the earliest; discussion #16470), the complementary-and-strictly-broader stance, a capability comparison against the native draft, and the link-model migration honesty ((mode, provider name, subject) + TOFU issuer vs upstream's (providerId, issuer, subject) key; legacy username links; SAML links stay plugin-owned). Roadmap gains the Upstream-watch section; Home and the sidebar link the page.
338e359
Add wiki navigation: curated sidebar and footer [#752]
Sidebar mirrors Home's four sections (user docs, architecture & security, process & release, design records) so every page carries the full map; footer carries the repo links, the private-security-reporting pointer and the wiki's code-wins disclaimer. Closes #752 (wiki side).
6db285f
Roadmap: document how Beta→RC promotion is decided (P8 epic #716)
e4ce940
Updated OpenSSF Best Practices (markdown)
15fd859
Clarify distribution: independent repository, not the official catalog (#739)
Note under Installation that this is an independent plugin repository (Jellyfin's
built-in catalog lists only jellyfin-org plugins; no official SSO plugin exists),
and record the distribution decision in the Roadmap: independent for now, org
adoption path kept open.
e53ef76
Advance maturity to Beta and add the role-gate denial troubleshooting entry
Flip Home/Roadmap/Migrating from Alpha to Beta for the 4.3.0 release: drop the
Alpha for-testing-only warning block for a concise Beta status, move the ladder
marker to Beta, and soften the production-use wording to Beta-appropriate. Add a
Troubleshooting entry mapping the reworded role-gate denial message (#668).
21c8504
Updated Delivery Metrics (markdown)
b379af5
Document SSO-only login: runbook, security summary, lockout recovery
The mode shipped (#665) but the wiki still called it not implemented, and
the settings page points at a Provider Setup runbook that did not exist.
- Provider Setup: full operator runbook (enforcement semantics, break-glass
guard, the four elevation-gated endpoints, server-managed state, recovery)
- Security Model: enforcement-property summary and the audited transitions
- Troubleshooting: locked-out recovery entry (break-glass, config-XML edit)
- SSO-Only Login Design: status corrected to implemented, kept as the record
- Home: feature listed under what it does today
837de97
Refresh wiki to Alpha stage, packaged-release install, and three-part versioning
- Home/Installation/Migrating: replace the In-Development banner with the Alpha
maturity; document the plugin-catalog install (stable/beta manifest URLs) and the
multi-target net9.0/net10.0 build for Jellyfin 10.11 and 12.0; drop the
build-from-source-only / no-manifest wording now that the channels are live.
- Release-Policy/OpenSSF: describe the three-part X.Y.Z scheme, with the channel and
Jellyfin generation as a tag/release-name suffix and Z covering both bug-fix and
security, instead of the retired four-part X.Y.Z.W (W=security).
- Provider-Setup: fix "recieve" typo.
- OpenSSF/Release-Policy/Release-QA-Checklist/Rollback/Threat-Model: use the wiki page
name as link text for docs that moved out of the repo (Review Gate, Rollback,
Release QA Checklist, Provider Setup, Architecture Internals, Threat Model).
8dfb8e6
Migrate design, process, and provider docs from the repo into the wiki
Add wiki pages for the per-provider setup guides, the delivery-pipeline
threat model, the release/rollback/review-gate/QA process docs, the DORA
delivery metrics, the OpenSSF best-practices assessment, the single-logout
and SSO-only-login design notes, and an architecture-internals code map.
Retarget every internal link: cross-doc references now point at wiki pages,
references to files that stay in the repo point at full github blob URLs,
and provider screenshots point at raw.githubusercontent URLs. Add a grouped
navigation to Home (user docs / architecture & security / process & release
/ design records), cross-link Login-Flow and Architecture with the new
Architecture-Internals map, and cross-link Security-Model with Threat-Model.
0501533
Architecture: mark the structural core delivered and conformance-locked
The four-layer shape, the VerifiedIdentity evidence keystone, the per-protocol
flow spine, LoginCompletionService, and the naming/purity rules have all landed
and are enforced by the 28-rule conformance suite. Reframe the page from a
target being migrated toward to the standard now in force, and state honestly
what was deliberately not pursued (the controller partial-split and the
top-level domain-folder reorg) as churn the conformance tests make unnecessary.
c6c638f
Advance the maturity ladder marker to Alpha
v4.1.0.0 is released and installable from the Jellyfin plugin catalog, so the
current stage moves from In-Development to Alpha. Softens the pre-release caveat
to match (testing/evaluation only, not production; a login path still being hardened).
39a3487
Document issuer-binding, secrets-at-rest, and the legacy-link upgrade path
Mirror the current providers.md security posture onto the wiki:
- Security-Model: issuer-bound OpenID links (repointing protection), secrets
encrypted at rest (ssoenc envelope + downgrade note), and the admin-account
exemption for the legacy username-keyed link migration.
- Migrating-from-9p4: issuer-binding behavior and the encrypted-secret rollback
caveat.
- Troubleshooting: the post-upgrade gated legacy-link case (403 / fresh account).
Closes #371.
6948b78
Document the login browser binding, SAML response-binding options, and per-client in-flight capacity
Merged since the last wiki pass: the SAML browser-binding cookie (#415) alongside the existing OpenID one, and the per-client share of the in-flight state stores (#327). The Security Model page now covers both binding cookies, the opt-in ValidateRecipient/ValidateInResponseTo checks, and the capacity model; Troubleshooting gains the matching failure modes (HTTP-only deployments, cross-browser callbacks, lost InResponseTo correlation, IdP-initiated logins with ValidateInResponseTo on).
042f894
Document provider-disable semantics on the grant paths
e686fd9
Bring the migration status up to date through #390
b0185fb