@nockdev/awf 6.2.0 → 6.2.2

package/.agent/skills/core/authentication/data/oauth.yaml

@@ -1,248 +1,248 @@
 metadata:
   skill: authentication
   domain: oauth
-  version: 6.2.0
-  updated: '2026-02-05'
-  migrated_from: oauth-patterns.csv
+  version: 6.2.2
+  updated: "2026-02-05"
+  migrated_from: oauth-patterns.yaml
   patterns_count: 30
 patterns:
-- id: OAUTH-001
-  pattern: OAuth 2.1 Standard
-  description: Updated RFC with security best practices
-  category: standards
-  security_level: high
-  keywords:
-  - oauth2.1
-  - rfc
-- id: OAUTH-002
-  pattern: Authorization Code Flow
-  description: Redirect-based code exchange for web apps
-  category: flows
-  security_level: high
-  keywords:
-  - authz-code
-  - web
-- id: OAUTH-003
-  pattern: PKCE Extension
-  description: Proof Key for Code Exchange prevents interception
-  category: security
-  security_level: critical
-  keywords:
-  - pkce
-  - verifier
-- id: OAUTH-004
-  pattern: Client Credentials Flow
-  description: Service-to-service machine authentication
-  category: flows
-  security_level: high
-  keywords:
-  - client-creds
-  - m2m
-- id: OAUTH-005
-  pattern: Device Authorization Flow
-  description: For devices without browser (CLI TV)
-  category: flows
-  security_level: medium
-  keywords:
-  - device
-  - cli
-- id: OAUTH-006
-  pattern: Implicit Flow Deprecated
-  description: Removed in OAuth 2.1 due to security
-  category: deprecated
-  security_level: critical
-  keywords:
-  - implicit
-  - removed
-- id: OAUTH-007
-  pattern: Resource Owner Password Deprecated
-  description: Direct password not recommended
-  category: deprecated
-  security_level: critical
-  keywords:
-  - ropc
-  - password
-- id: OAUTH-008
-  pattern: Access Token
-  description: Short-lived bearer token for API access
-  category: tokens
-  security_level: high
-  keywords:
-  - access
-  - bearer
-- id: OAUTH-009
-  pattern: Refresh Token
-  description: Long-lived token for obtaining new access
-  category: tokens
-  security_level: high
-  keywords:
-  - refresh
-  - renewal
-- id: OAUTH-010
-  pattern: ID Token (OIDC)
-  description: JWT with user identity claims
-  category: tokens
-  security_level: high
-  keywords:
-  - id-token
-  - oidc
-- id: OAUTH-011
-  pattern: State Parameter
-  description: CSRF protection in authorization request
-  category: security
-  security_level: critical
-  keywords:
-  - state
-  - csrf
-- id: OAUTH-012
-  pattern: Nonce Parameter
-  description: Replay protection for ID tokens
-  category: security
-  security_level: high
-  keywords:
-  - nonce
-  - replay
-- id: OAUTH-013
-  pattern: Scope Requesting
-  description: Request minimal permissions needed
-  category: authorization
-  security_level: high
-  keywords:
-  - scope
-  - minimal
-- id: OAUTH-014
-  pattern: Token Introspection
-  description: Server-side token validation endpoint
-  category: infrastructure
-  security_level: high
-  keywords:
-  - introspect
-  - validate
-- id: OAUTH-015
-  pattern: Token Revocation Endpoint
-  description: Invalidate tokens before expiry
-  category: infrastructure
-  security_level: high
-  keywords:
-  - revoke
-  - endpoint
-- id: OAUTH-016
-  pattern: Authorization Server Metadata
-  description: Discovery of OAuth endpoints
-  category: infrastructure
-  security_level: medium
-  keywords:
-  - discovery
-  - metadata
-- id: OAUTH-017
-  pattern: Client Registration
-  description: Dynamic client registration protocol
-  category: infrastructure
-  security_level: medium
-  keywords:
-  - registration
-  - client
-- id: OAUTH-018
-  pattern: Sender-Constrained Tokens
-  description: DPoP or mTLS bound tokens
-  category: security
-  security_level: high
-  keywords:
-  - dpop
-  - mtls
-- id: OAUTH-019
-  pattern: DPoP (Proof of Possession)
-  description: Demonstrate token ownership
-  category: security
-  security_level: high
-  keywords:
-  - dpop
-  - proof
-- id: OAUTH-020
-  pattern: mTLS Client Auth
-  description: Mutual TLS for client authentication
-  category: security
-  security_level: high
-  keywords:
-  - mtls
-  - certificate
-- id: OAUTH-021
-  pattern: Private Key JWT
-  description: Client auth using signed JWT assertion
-  category: security
-  security_level: high
-  keywords:
-  - private-key-jwt
-  - assertion
-- id: OAUTH-022
-  pattern: OIDC Claims Request
-  description: Request specific user info claims
-  category: user-info
-  security_level: medium
-  keywords:
-  - claims
-  - request
-- id: OAUTH-023
-  pattern: UserInfo Endpoint
-  description: Retrieve user profile information
-  category: infrastructure
-  security_level: medium
-  keywords:
-  - userinfo
-  - profile
-- id: OAUTH-024
-  pattern: Redirect URI Validation
-  description: Exact match redirect URI required
-  category: security
-  security_level: critical
-  keywords:
-  - redirect
-  - validation
-- id: OAUTH-025
-  pattern: Native App Best Practices
-  description: PKCE with custom scheme or loopback
-  category: mobile
-  security_level: high
-  keywords:
-  - native
-  - pkce
-- id: OAUTH-026
-  pattern: SPA Best Practices
-  description: BFF pattern or token handler
-  category: web
-  security_level: high
-  keywords:
-  - spa
-  - bff
-- id: OAUTH-027
-  pattern: Token Exchange
-  description: RFC 8693 impersonation and delegation
-  category: flows
-  security_level: high
-  keywords:
-  - exchange
-  - delegation
-- id: OAUTH-028
-  pattern: Pushed Authorization Requests
-  description: PAR for enhanced security
-  category: security
-  security_level: high
-  keywords:
-  - par
-  - pushed
-- id: OAUTH-029
-  pattern: Rich Authorization Requests
-  description: Fine-grained authorization data
-  category: authorization
-  security_level: medium
-  keywords:
-  - rar
-  - finegrained
-- id: OAUTH-030
-  pattern: Proof of Possession
-  description: Cryptographic binding of tokens
-  category: security
-  security_level: high
-  keywords:
-  - pop
-  - binding
+  - id: OAUTH-001
+    pattern: OAuth 2.1 Standard
+    description: Updated RFC with security best practices
+    category: standards
+    security_level: high
+    keywords:
+      - oauth2.1
+      - rfc
+  - id: OAUTH-002
+    pattern: Authorization Code Flow
+    description: Redirect-based code exchange for web apps
+    category: flows
+    security_level: high
+    keywords:
+      - authz-code
+      - web
+  - id: OAUTH-003
+    pattern: PKCE Extension
+    description: Proof Key for Code Exchange prevents interception
+    category: security
+    security_level: critical
+    keywords:
+      - pkce
+      - verifier
+  - id: OAUTH-004
+    pattern: Client Credentials Flow
+    description: Service-to-service machine authentication
+    category: flows
+    security_level: high
+    keywords:
+      - client-creds
+      - m2m
+  - id: OAUTH-005
+    pattern: Device Authorization Flow
+    description: For devices without browser (CLI TV)
+    category: flows
+    security_level: medium
+    keywords:
+      - device
+      - cli
+  - id: OAUTH-006
+    pattern: Implicit Flow Deprecated
+    description: Removed in OAuth 2.1 due to security
+    category: deprecated
+    security_level: critical
+    keywords:
+      - implicit
+      - removed
+  - id: OAUTH-007
+    pattern: Resource Owner Password Deprecated
+    description: Direct password not recommended
+    category: deprecated
+    security_level: critical
+    keywords:
+      - ropc
+      - password
+  - id: OAUTH-008
+    pattern: Access Token
+    description: Short-lived bearer token for API access
+    category: tokens
+    security_level: high
+    keywords:
+      - access
+      - bearer
+  - id: OAUTH-009
+    pattern: Refresh Token
+    description: Long-lived token for obtaining new access
+    category: tokens
+    security_level: high
+    keywords:
+      - refresh
+      - renewal
+  - id: OAUTH-010
+    pattern: ID Token (OIDC)
+    description: JWT with user identity claims
+    category: tokens
+    security_level: high
+    keywords:
+      - id-token
+      - oidc
+  - id: OAUTH-011
+    pattern: State Parameter
+    description: CSRF protection in authorization request
+    category: security
+    security_level: critical
+    keywords:
+      - state
+      - csrf
+  - id: OAUTH-012
+    pattern: Nonce Parameter
+    description: Replay protection for ID tokens
+    category: security
+    security_level: high
+    keywords:
+      - nonce
+      - replay
+  - id: OAUTH-013
+    pattern: Scope Requesting
+    description: Request minimal permissions needed
+    category: authorization
+    security_level: high
+    keywords:
+      - scope
+      - minimal
+  - id: OAUTH-014
+    pattern: Token Introspection
+    description: Server-side token validation endpoint
+    category: infrastructure
+    security_level: high
+    keywords:
+      - introspect
+      - validate
+  - id: OAUTH-015
+    pattern: Token Revocation Endpoint
+    description: Invalidate tokens before expiry
+    category: infrastructure
+    security_level: high
+    keywords:
+      - revoke
+      - endpoint
+  - id: OAUTH-016
+    pattern: Authorization Server Metadata
+    description: Discovery of OAuth endpoints
+    category: infrastructure
+    security_level: medium
+    keywords:
+      - discovery
+      - metadata
+  - id: OAUTH-017
+    pattern: Client Registration
+    description: Dynamic client registration protocol
+    category: infrastructure
+    security_level: medium
+    keywords:
+      - registration
+      - client
+  - id: OAUTH-018
+    pattern: Sender-Constrained Tokens
+    description: DPoP or mTLS bound tokens
+    category: security
+    security_level: high
+    keywords:
+      - dpop
+      - mtls
+  - id: OAUTH-019
+    pattern: DPoP (Proof of Possession)
+    description: Demonstrate token ownership
+    category: security
+    security_level: high
+    keywords:
+      - dpop
+      - proof
+  - id: OAUTH-020
+    pattern: mTLS Client Auth
+    description: Mutual TLS for client authentication
+    category: security
+    security_level: high
+    keywords:
+      - mtls
+      - certificate
+  - id: OAUTH-021
+    pattern: Private Key JWT
+    description: Client auth using signed JWT assertion
+    category: security
+    security_level: high
+    keywords:
+      - private-key-jwt
+      - assertion
+  - id: OAUTH-022
+    pattern: OIDC Claims Request
+    description: Request specific user info claims
+    category: user-info
+    security_level: medium
+    keywords:
+      - claims
+      - request
+  - id: OAUTH-023
+    pattern: UserInfo Endpoint
+    description: Retrieve user profile information
+    category: infrastructure
+    security_level: medium
+    keywords:
+      - userinfo
+      - profile
+  - id: OAUTH-024
+    pattern: Redirect URI Validation
+    description: Exact match redirect URI required
+    category: security
+    security_level: critical
+    keywords:
+      - redirect
+      - validation
+  - id: OAUTH-025
+    pattern: Native App Best Practices
+    description: PKCE with custom scheme or loopback
+    category: mobile
+    security_level: high
+    keywords:
+      - native
+      - pkce
+  - id: OAUTH-026
+    pattern: SPA Best Practices
+    description: BFF pattern or token handler
+    category: web
+    security_level: high
+    keywords:
+      - spa
+      - bff
+  - id: OAUTH-027
+    pattern: Token Exchange
+    description: RFC 8693 impersonation and delegation
+    category: flows
+    security_level: high
+    keywords:
+      - exchange
+      - delegation
+  - id: OAUTH-028
+    pattern: Pushed Authorization Requests
+    description: PAR for enhanced security
+    category: security
+    security_level: high
+    keywords:
+      - par
+      - pushed
+  - id: OAUTH-029
+    pattern: Rich Authorization Requests
+    description: Fine-grained authorization data
+    category: authorization
+    security_level: medium
+    keywords:
+      - rar
+      - finegrained
+  - id: OAUTH-030
+    pattern: Proof of Possession
+    description: Cryptographic binding of tokens
+    category: security
+    security_level: high
+    keywords:
+      - pop
+      - binding

package/.agent/skills/core/authentication/data/passkey-patterns.yaml

@@ -0,0 +1,149 @@
+# =============================================================================
+# passkey-patterns.yaml — WebAuthn / Passkey Authentication
+# =============================================================================
+
+version: "1.0.0"
+
+overview:
+  description: |
+    Passkeys replace passwords with cryptographic key pairs bound to
+    devices. Based on WebAuthn standard (FIDO2). Phishing-resistant,
+    no shared secrets, biometric-enabled.
+
+  benefits:
+    - "Phishing-resistant (origin-bound)"
+    - "No password to leak or forget"
+    - "Biometric convenience (Face ID, fingerprint)"
+    - "Cross-device sync (iCloud Keychain, Google Password Manager)"
+
+registration:
+  flow: |
+    1. Server generates challenge (random bytes)
+    2. Browser calls navigator.credentials.create()
+    3. Authenticator creates key pair
+    4. Public key sent to server
+    5. Server stores public key + credential ID
+
+  frontend: |
+    // Registration (client-side)
+    const options = await fetch('/api/auth/register/options', {
+      method: 'POST',
+      body: JSON.stringify({ username: 'user@example.com' }),
+    }).then(r => r.json());
+
+    const credential = await navigator.credentials.create({
+      publicKey: {
+        challenge: base64url.decode(options.challenge),
+        rp: { name: 'My App', id: 'example.com' },
+        user: {
+          id: base64url.decode(options.userId),
+          name: 'user@example.com',
+          displayName: 'User',
+        },
+        pubKeyCredParams: [
+          { type: 'public-key', alg: -7 },   // ES256
+          { type: 'public-key', alg: -257 },  // RS256
+        ],
+        authenticatorSelection: {
+          residentKey: 'required',        // Discoverable credential
+          userVerification: 'preferred',   // Biometric when available
+        },
+        timeout: 60000,
+      },
+    });
+
+    // Send credential to server for storage
+    await fetch('/api/auth/register/verify', {
+      method: 'POST',
+      body: JSON.stringify(credential),
+    });
+
+authentication:
+  flow: |
+    1. Server generates challenge
+    2. Browser calls navigator.credentials.get()
+    3. Authenticator signs challenge with private key
+    4. Server verifies signature with stored public key
+    5. User authenticated
+
+  frontend: |
+    // Authentication (client-side)
+    const options = await fetch('/api/auth/login/options', {
+      method: 'POST',
+    }).then(r => r.json());
+
+    const assertion = await navigator.credentials.get({
+      publicKey: {
+        challenge: base64url.decode(options.challenge),
+        rpId: 'example.com',
+        allowCredentials: [], // Empty = discoverable credential
+        userVerification: 'preferred',
+        timeout: 60000,
+      },
+    });
+
+    const result = await fetch('/api/auth/login/verify', {
+      method: 'POST',
+      body: JSON.stringify(assertion),
+    }).then(r => r.json());
+
+server_libraries:
+  typescript:
+    name: "@simplewebauthn/server"
+    example: |
+      import {
+        generateRegistrationOptions,
+        verifyRegistrationResponse,
+        generateAuthenticationOptions,
+        verifyAuthenticationResponse,
+      } from '@simplewebauthn/server';
+
+      // Generate registration options
+      const options = await generateRegistrationOptions({
+        rpName: 'My App',
+        rpID: 'example.com',
+        userName: user.email,
+        attestationType: 'none',
+        authenticatorSelection: {
+          residentKey: 'required',
+          userVerification: 'preferred',
+        },
+      });
+
+  go:
+    name: "go-webauthn/webauthn"
+    example: |
+      import "github.com/go-webauthn/webauthn/webauthn"
+
+      web, _ := webauthn.New(&webauthn.Config{
+          RPDisplayName: "My App",
+          RPID:          "example.com",
+          RPOrigins:     []string{"https://example.com"},
+      })
+
+      options, session, _ := web.BeginRegistration(user)
+
+  python:
+    name: "py_webauthn"
+
+database_schema: |
+  CREATE TABLE passkeys (
+      id              UUID PRIMARY KEY,
+      user_id         UUID REFERENCES users(id),
+      credential_id   BYTEA UNIQUE NOT NULL,
+      public_key      BYTEA NOT NULL,
+      sign_count      BIGINT DEFAULT 0,
+      transports      TEXT[],
+      created_at      TIMESTAMPTZ DEFAULT NOW(),
+      last_used_at    TIMESTAMPTZ
+  );
+
+migration_strategy:
+  description: "Gradual migration from passwords to passkeys"
+  phases:
+    - "Phase 1: Offer passkey as optional 2FA"
+    - "Phase 2: Prompt password users to add passkey"
+    - "Phase 3: Allow passkey-only accounts"
+    - "Phase 4: Deprecate password login (optional)"
+
+# _DOMYH Awesome Code • Passkey Patterns_