mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.8 KiB
2.8 KiB
OAuth 2.0 Authorization Flow Configuration Template
Application Registration
| Field | Value |
|---|---|
| Application Name | |
| Client ID | |
| Client Type | [ ] Public [ ] Confidential |
| Grant Types | [ ] Authorization Code [ ] Client Credentials [ ] Refresh Token [ ] Device Code |
| PKCE Required | [ ] Yes (mandatory for OAuth 2.1) |
Redirect URI Configuration
| Environment | URI | Status |
|---|---|---|
| Development | http://localhost:3000/callback | [ ] Registered |
| Staging | https://staging.example.com/callback | [ ] Registered |
| Production | https://app.example.com/callback | [ ] Registered |
Rules:
- Exact match only - no wildcards
- HTTPS required for non-localhost URIs
- Each URI must be explicitly registered
Scope Design
| Scope | Description | Sensitivity |
|---|---|---|
| openid | OpenID Connect identity | Low |
| profile | User profile information | Low |
| User email address | Low | |
| read:users | Read user records | Medium |
| write:users | Modify user records | High |
| admin:settings | Modify system settings | Critical |
Token Configuration
| Parameter | Value | Justification |
|---|---|---|
| Access Token Lifetime | 15 minutes | Minimize window of exposure |
| Refresh Token Lifetime | 8 hours | Align with business hours |
| Refresh Token Rotation | Enabled | Detect token theft via reuse |
| Refresh Token Absolute Expiry | 24 hours | Force re-authentication daily |
| ID Token Lifetime | 5 minutes | Only used for initial authentication |
| Token Format | JWT (signed) | Enable stateless validation |
| Signing Algorithm | RS256 | Asymmetric verification |
Security Checklist
- PKCE enforced for all authorization code flows
- Implicit grant disabled
- ROPC (password) grant disabled
- State parameter validated
- Exact redirect URI matching enforced
- Refresh token rotation enabled
- Token revocation endpoint active
- DPoP enabled for high-security APIs
- Consent screen configured for sensitive scopes
- Token introspection secured with authentication
Client Authentication Methods
| Method | Use Case | Security Level |
|---|---|---|
| none | Public clients (SPA, mobile) | Requires PKCE |
| client_secret_basic | Server-side web apps | Medium |
| client_secret_post | Server-side web apps | Medium |
| private_key_jwt | High-security services | High |
| tls_client_auth | mTLS-capable services | High |
Monitoring & Alerting
- Token issuance rate monitoring
- Failed authentication attempts tracking
- Refresh token reuse detection alerts
- Scope escalation attempt alerts
- Unusual client_id activity monitoring
- Geographic anomaly detection for token usage