Files
stack/docs
Jason Woltje 774b249fd5
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/pr/woodpecker Pipeline failed
fix(#271): implement OIDC token validation (authentication bypass)
Replaced placeholder OIDC token validation with real JWT verification
using the jose library. This fixes a critical authentication bypass
vulnerability where any attacker could impersonate any user on
federated instances.

Security Impact:
- FIXED: Complete authentication bypass (always returned valid:false)
- ADDED: JWT signature verification using HS256
- ADDED: Claim validation (iss, aud, exp, nbf, iat, sub)
- ADDED: Specific error handling for each failure type
- ADDED: 8 comprehensive security tests

Implementation:
- Made validateToken async (returns Promise)
- Added jose library integration for JWT verification
- Updated all callers to await async validation
- Fixed controller tests to use mockResolvedValue

Test Results:
- Federation tests: 229/229 passing 
- TypeScript: 0 errors 
- Lint: 0 errors 

Production TODO:
- Implement JWKS fetching from remote instances
- Add JWKS caching with TTL (1 hour)
- Support RS256 asymmetric keys

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-03 16:50:06 -06:00
..

Mosaic Stack Documentation

Complete documentation for Mosaic Stack, organized in Bookstack-compatible shelf/book/chapter/page structure.

📚 Books

1. Getting Started

Essential guides to get Mosaic Stack installed and configured.

2. Development

Developer guides for contributing to Mosaic Stack.

3. Architecture

Technical architecture and design decisions.

4. API Reference

Complete API endpoint documentation.

📝 Scratchpads

Development notes and implementation details for specific issues:

For New Users

  1. Quick Start
  2. Local Setup
  3. Environment Configuration

For Developers

  1. Branching Strategy
  2. Testing Requirements
  3. Type Sharing

For Architects

  1. PDA-Friendly Design
  2. Authentication Flow (to be added)
  3. System Overview (to be added)

For API Consumers

  1. API Conventions
  2. Authentication Endpoints

📋 Documentation Standards

File Organization

docs/
├── {N}-{book-name}/              # Book (numbered)
│   ├── README.md                 # Book overview
│   ├── {N}-{chapter-name}/       # Chapter (numbered)
│   │   ├── {N}-{page-name}.md    # Page (numbered)
│   │   └── ...
│   └── ...
└── scratchpads/                  # Development notes (unnumbered)

Numbering Convention

  • Books: 1-getting-started, 2-development, 3-architecture, 4-api
  • Chapters: 1-quick-start, 2-installation, 3-configuration
  • Pages: 1-overview.md, 2-local-setup.md, 3-docker-setup.md

Numbers maintain order in file systems and Bookstack.

Writing Style

  • Concise — No unnecessary verbosity
  • Action-oriented — Use imperative mood ("Run the command", not "You should run")
  • Example-heavy — Show, don't just tell
  • Code blocks — Always include working examples
  • Links — Cross-reference related topics
  • PDA-friendly — Follow design principles

Code Examples

Always include:

  • Language identifier for syntax highlighting
  • Complete, runnable examples
  • Expected output when relevant
  • Error cases and troubleshooting

🛠️ Contributing to Docs

Adding New Pages

  1. Identify the appropriate book/chapter
  2. Create numbered markdown file
  3. Add to chapter's parent README
  4. Link from related pages
  5. Test all links and code examples

Updating Existing Pages

  1. Keep formatting consistent
  2. Update last-modified date
  3. Test all examples
  4. Check cross-references

Creating New Books

  1. Number sequentially (5-{new-book})
  2. Create README.md overview
  3. Add chapter directories
  4. Update this index

📊 Documentation Status

Book Completion
Getting Started 🟢 Complete
Development 🟡 Partial
Architecture 🟡 Partial
API Reference 🟡 Partial

Legend:

  • 🟢 Complete
  • 🟡 Partial
  • 🔵 Planned
  • Not started

🔗 External Resources

📧 Support


Last Updated: 2026-01-28 Version: 0.0.1 (Pre-MVP)