@nockdev/awf 6.2.0

package/.agent/skills/core/authentication/data/core-patterns.yaml

@@ -0,0 +1,256 @@
+metadata:
+  skill: authentication
+  domain: core_patterns
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: core-patterns.csv
+  patterns_count: 30
+  columns:
+  - id
+  - pattern_name
+  - description
+  - category
+  - security_level
+  - keywords
+patterns:
+- id: CORE-001
+  pattern_name: Three Authentication Factors
+  description: Knowledge (password) + Possession (device) + Inherence (biometric) = MFA
+  category: fundamentals
+  security_level: high
+  keywords:
+  - factors
+  - mfa
+  - biometric
+- id: CORE-002
+  pattern_name: Zero Trust Model
+  description: Never trust always verify - authenticate every request
+  category: architecture
+  security_level: critical
+  keywords:
+  - zero-trust
+  - verification
+- id: CORE-003
+  pattern_name: Defense in Depth
+  description: Multiple layers of authentication and authorization
+  category: architecture
+  security_level: high
+  keywords:
+  - layers
+  - defense
+- id: CORE-004
+  pattern_name: Principle of Least Privilege
+  description: Grant minimum permissions required
+  category: authorization
+  security_level: high
+  keywords:
+  - rbac
+  - permissions
+- id: CORE-005
+  pattern_name: Separation of Duties
+  description: Different roles for different operations
+  category: authorization
+  security_level: high
+  keywords:
+  - roles
+  - duties
+- id: CORE-006
+  pattern_name: Authentication vs Authorization
+  description: Authn = who you are; Authz = what you can do
+  category: fundamentals
+  security_level: medium
+  keywords:
+  - authn
+  - authz
+- id: CORE-007
+  pattern_name: Identity Federation
+  description: Trust relationships between identity providers
+  category: architecture
+  security_level: high
+  keywords:
+  - federation
+  - sso
+- id: CORE-008
+  pattern_name: Single Sign-On (SSO)
+  description: One login for multiple applications
+  category: user-experience
+  security_level: medium
+  keywords:
+  - sso
+  - convenience
+- id: CORE-009
+  pattern_name: Session Management
+  description: Track authenticated state across requests
+  category: state
+  security_level: high
+  keywords:
+  - session
+  - cookies
+- id: CORE-010
+  pattern_name: Token-Based Authentication
+  description: Stateless auth using signed tokens
+  category: architecture
+  security_level: high
+  keywords:
+  - jwt
+  - tokens
+- id: CORE-011
+  pattern_name: Credential Rotation
+  description: Regularly rotate passwords and secrets
+  category: security
+  security_level: critical
+  keywords:
+  - rotation
+  - secrets
+- id: CORE-012
+  pattern_name: Secure Credential Storage
+  description: Never store plaintext credentials
+  category: security
+  security_level: critical
+  keywords:
+  - hashing
+  - encryption
+- id: CORE-013
+  pattern_name: Rate Limiting Login
+  description: Prevent brute force attacks
+  category: security
+  security_level: high
+  keywords:
+  - rate-limit
+  - bruteforce
+- id: CORE-014
+  pattern_name: Account Lockout Policy
+  description: Lock after failed attempts
+  category: security
+  security_level: high
+  keywords:
+  - lockout
+  - attempts
+- id: CORE-015
+  pattern_name: Audit Logging
+  description: Log all authentication events
+  category: compliance
+  security_level: high
+  keywords:
+  - audit
+  - logging
+- id: CORE-016
+  pattern_name: Secure Password Reset
+  description: Token-based time-limited reset
+  category: security
+  security_level: high
+  keywords:
+  - reset
+  - recovery
+- id: CORE-017
+  pattern_name: Email Verification
+  description: Verify email ownership before activation
+  category: security
+  security_level: medium
+  keywords:
+  - email
+  - verification
+- id: CORE-018
+  pattern_name: Phone Verification
+  description: SMS or voice code verification
+  category: security
+  security_level: medium
+  keywords:
+  - phone
+  - sms
+- id: CORE-019
+  pattern_name: CAPTCHA Integration
+  description: Prevent automated attacks
+  category: security
+  security_level: medium
+  keywords:
+  - captcha
+  - bot
+- id: CORE-020
+  pattern_name: Geolocation Checks
+  description: Verify login location anomalies
+  category: security
+  security_level: medium
+  keywords:
+  - geo
+  - location
+- id: CORE-021
+  pattern_name: Device Fingerprinting
+  description: Track trusted devices
+  category: security
+  security_level: medium
+  keywords:
+  - device
+  - fingerprint
+- id: CORE-022
+  pattern_name: Remember Me Feature
+  description: Extended session with secure token
+  category: user-experience
+  security_level: medium
+  keywords:
+  - remember
+  - persistent
+- id: CORE-023
+  pattern_name: Logout Handling
+  description: Invalidate all tokens and sessions
+  category: security
+  security_level: high
+  keywords:
+  - logout
+  - invalidation
+- id: CORE-024
+  pattern_name: Cross-Origin Auth
+  description: CORS and SameSite cookie policies
+  category: security
+  security_level: high
+  keywords:
+  - cors
+  - samesite
+- id: CORE-025
+  pattern_name: Auth State Machine
+  description: Formal state transitions for auth flow
+  category: architecture
+  security_level: medium
+  keywords:
+  - state
+  - machine
+- id: CORE-026
+  pattern_name: Graceful Degradation
+  description: Fallback when auth service unavailable
+  category: reliability
+  security_level: medium
+  keywords:
+  - fallback
+  - degradation
+- id: CORE-027
+  pattern_name: Auth Error Messages
+  description: Non-revealing error responses
+  category: security
+  security_level: high
+  keywords:
+  - errors
+  - enumeration
+- id: CORE-028
+  pattern_name: Consent Management
+  description: Track user consent for data usage
+  category: compliance
+  security_level: medium
+  keywords:
+  - consent
+  - gdpr
+- id: CORE-029
+  pattern_name: Privacy by Design
+  description: Minimize stored authentication data
+  category: compliance
+  security_level: high
+  keywords:
+  - privacy
+  - minimal
+- id: CORE-030
+  pattern_name: Threat Modeling
+  description: STRIDE analysis for auth systems
+  category: security
+  security_level: critical
+  keywords:
+  - threats
+  - stride

package/.agent/skills/core/authentication/data/jwt-patterns.yaml

@@ -0,0 +1,255 @@
+metadata:
+  skill: authentication
+  domain: jwt_patterns
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: jwt-patterns.csv
+  patterns_count: 30
+  columns:
+  - id
+  - pattern_name
+  - description
+  - category
+  - security_level
+  - keywords
+patterns:
+- id: JWT-001
+  pattern_name: JWT Structure
+  description: Header.Payload.Signature base64url encoded
+  category: fundamentals
+  security_level: medium
+  keywords:
+  - structure
+  - parts
+- id: JWT-002
+  pattern_name: Symmetric Signing (HS256)
+  description: HMAC-SHA256 shared secret signing
+  category: algorithms
+  security_level: medium
+  keywords:
+  - hs256
+  - hmac
+- id: JWT-003
+  pattern_name: Asymmetric Signing (RS256)
+  description: RSA-SHA256 public/private key signing
+  category: algorithms
+  security_level: high
+  keywords:
+  - rs256
+  - rsa
+- id: JWT-004
+  pattern_name: ES256 Algorithm
+  description: ECDSA P-256 curve signing - compact and fast
+  category: algorithms
+  security_level: high
+  keywords:
+  - es256
+  - ecdsa
+- id: JWT-005
+  pattern_name: JWT Expiration (exp)
+  description: Required claim for token lifetime
+  category: claims
+  security_level: critical
+  keywords:
+  - exp
+  - expiry
+- id: JWT-006
+  pattern_name: JWT Issued At (iat)
+  description: Timestamp of token creation
+  category: claims
+  security_level: medium
+  keywords:
+  - iat
+  - issued
+- id: JWT-007
+  pattern_name: JWT Not Before (nbf)
+  description: Token not valid before this time
+  category: claims
+  security_level: medium
+  keywords:
+  - nbf
+  - notbefore
+- id: JWT-008
+  pattern_name: JWT Issuer (iss)
+  description: Identifies token issuer
+  category: claims
+  security_level: high
+  keywords:
+  - iss
+  - issuer
+- id: JWT-009
+  pattern_name: JWT Audience (aud)
+  description: Intended recipient of token
+  category: claims
+  security_level: high
+  keywords:
+  - aud
+  - audience
+- id: JWT-010
+  pattern_name: JWT Subject (sub)
+  description: Unique user identifier
+  category: claims
+  security_level: high
+  keywords:
+  - sub
+  - subject
+- id: JWT-011
+  pattern_name: JWT ID (jti)
+  description: Unique token identifier for revocation
+  category: claims
+  security_level: high
+  keywords:
+  - jti
+  - id
+- id: JWT-012
+  pattern_name: Short-Lived Access Tokens
+  description: 15-30 minute expiry for access tokens
+  category: best-practice
+  security_level: critical
+  keywords:
+  - short
+  - access
+- id: JWT-013
+  pattern_name: Long-Lived Refresh Tokens
+  description: 7-30 day expiry stored securely
+  category: best-practice
+  security_level: high
+  keywords:
+  - refresh
+  - long
+- id: JWT-014
+  pattern_name: Token Refresh Flow
+  description: Use refresh token to get new access token
+  category: flows
+  security_level: high
+  keywords:
+  - refresh
+  - rotation
+- id: JWT-015
+  pattern_name: Refresh Token Rotation
+  description: Issue new refresh token on each use
+  category: security
+  security_level: critical
+  keywords:
+  - rotation
+  - single-use
+- id: JWT-016
+  pattern_name: Token Revocation
+  description: Blacklist or allowlist for invalidation
+  category: security
+  security_level: high
+  keywords:
+  - revocation
+  - blacklist
+- id: JWT-017
+  pattern_name: HttpOnly Cookie Storage
+  description: Prevent XSS access to tokens
+  category: security
+  security_level: critical
+  keywords:
+  - httponly
+  - cookie
+- id: JWT-018
+  pattern_name: Secure Cookie Flag
+  description: Only send over HTTPS
+  category: security
+  security_level: critical
+  keywords:
+  - secure
+  - https
+- id: JWT-019
+  pattern_name: SameSite Cookie Policy
+  description: CSRF protection via cookie attribute
+  category: security
+  security_level: high
+  keywords:
+  - samesite
+  - csrf
+- id: JWT-020
+  pattern_name: Memory Storage for SPA
+  description: Store access token in memory only
+  category: security
+  security_level: high
+  keywords:
+  - memory
+  - spa
+- id: JWT-021
+  pattern_name: Avoid localStorage
+  description: XSS vulnerable for token storage
+  category: anti-pattern
+  security_level: critical
+  keywords:
+  - localstorage
+  - xss
+- id: JWT-022
+  pattern_name: Token Fingerprinting
+  description: Bind token to device/session
+  category: security
+  security_level: high
+  keywords:
+  - fingerprint
+  - binding
+- id: JWT-023
+  pattern_name: JWT Encryption (JWE)
+  description: Encrypt payload for sensitive data
+  category: security
+  security_level: high
+  keywords:
+  - jwe
+  - encryption
+- id: JWT-024
+  pattern_name: JWKS Endpoint
+  description: Public key distribution for verification
+  category: infrastructure
+  security_level: high
+  keywords:
+  - jwks
+  - keys
+- id: JWT-025
+  pattern_name: Key Rotation
+  description: Regular rotation of signing keys
+  category: security
+  security_level: critical
+  keywords:
+  - rotation
+  - keys
+- id: JWT-026
+  pattern_name: Algorithm Header Validation
+  description: Reject none and unexpected algorithms
+  category: security
+  security_level: critical
+  keywords:
+  - alg
+  - validation
+- id: JWT-027
+  pattern_name: Signature Verification
+  description: Always verify before trusting claims
+  category: security
+  security_level: critical
+  keywords:
+  - verify
+  - signature
+- id: JWT-028
+  pattern_name: Claim Validation
+  description: Validate iss aud exp after signature
+  category: security
+  security_level: high
+  keywords:
+  - claims
+  - validation
+- id: JWT-029
+  pattern_name: Token Size Limits
+  description: Keep tokens under 8KB for headers
+  category: performance
+  security_level: medium
+  keywords:
+  - size
+  - limit
+- id: JWT-030
+  pattern_name: Stateless vs Stateful
+  description: Choose based on revocation requirements
+  category: architecture
+  security_level: medium
+  keywords:
+  - stateless
+  - stateful

package/.agent/skills/core/authentication/data/language-csharp.yaml

@@ -0,0 +1,215 @@
+metadata:
+  skill: authentication
+  domain: language_csharp
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: language-csharp.csv
+  patterns_count: 25
+  columns:
+  - id
+  - pattern_name
+  - description
+  - library
+  - security_level
+  - keywords
+patterns:
+- id: CS-001
+  pattern_name: ASP.NET Core Identity
+  description: Built-in identity system
+  library: Microsoft.AspNetCore.Identity
+  security_level: high
+  keywords:
+  - identity
+  - aspnet
+- id: CS-002
+  pattern_name: IdentityDbContext
+  description: EF Core identity storage
+  library: Microsoft.AspNetCore.Identity.EntityFrameworkCore
+  security_level: high
+  keywords:
+  - ef
+  - database
+- id: CS-003
+  pattern_name: UserManager
+  description: User CRUD operations
+  library: Microsoft.AspNetCore.Identity
+  security_level: high
+  keywords:
+  - user
+  - manager
+- id: CS-004
+  pattern_name: SignInManager
+  description: Sign in sign out handling
+  library: Microsoft.AspNetCore.Identity
+  security_level: high
+  keywords:
+  - signin
+  - manager
+- id: CS-005
+  pattern_name: JWT Bearer Authentication
+  description: Token-based API auth
+  library: Microsoft.AspNetCore.Authentication.JwtBearer
+  security_level: high
+  keywords:
+  - jwt
+  - bearer
+- id: CS-006
+  pattern_name: AddJwtBearer
+  description: Configure JWT validation
+  library: Microsoft.AspNetCore.Authentication.JwtBearer
+  security_level: high
+  keywords:
+  - config
+  - bearer
+- id: CS-007
+  pattern_name: JwtSecurityTokenHandler
+  description: Token creation and validation
+  library: System.IdentityModel.Tokens.Jwt
+  security_level: high
+  keywords:
+  - handler
+  - jwt
+- id: CS-008
+  pattern_name: TokenValidationParameters
+  description: Configure token validation
+  library: Microsoft.IdentityModel.Tokens
+  security_level: critical
+  keywords:
+  - validation
+  - params
+- id: CS-009
+  pattern_name: OAuth2 Authentication
+  description: OAuth2 with external providers
+  library: Microsoft.AspNetCore.Authentication.OAuth
+  security_level: high
+  keywords:
+  - oauth2
+  - providers
+- id: CS-010
+  pattern_name: OIDC Authentication
+  description: OpenID Connect integration
+  library: Microsoft.AspNetCore.Authentication.OpenIdConnect
+  security_level: high
+  keywords:
+  - oidc
+  - openid
+- id: CS-011
+  pattern_name: Cookie Authentication
+  description: Cookie-based session auth
+  library: Microsoft.AspNetCore.Authentication.Cookies
+  security_level: high
+  keywords:
+  - cookie
+  - session
+- id: CS-012
+  pattern_name: MSAL.NET
+  description: Microsoft identity platform
+  library: Microsoft.Identity.Client
+  security_level: high
+  keywords:
+  - msal
+  - azure
+- id: CS-013
+  pattern_name: Microsoft Identity Web
+  description: Azure AD integration
+  library: Microsoft.Identity.Web
+  security_level: high
+  keywords:
+  - azure
+  - ad
+- id: CS-014
+  pattern_name: Azure AD B2C
+  description: Consumer identity (deprecated May 2025)
+  library: Microsoft.Identity.Web
+  security_level: medium
+  keywords:
+  - b2c
+  - consumer
+- id: CS-015
+  pattern_name: Entra External ID
+  description: Customer identity replacement
+  library: Microsoft.Identity.Web
+  security_level: high
+  keywords:
+  - entra
+  - external
+- id: CS-016
+  pattern_name: Data Protection API
+  description: Key management and encryption
+  library: Microsoft.AspNetCore.DataProtection
+  security_level: critical
+  keywords:
+  - dpapi
+  - keys
+- id: CS-017
+  pattern_name: BCrypt.Net-Next
+  description: Password hashing library
+  library: BCrypt.Net
+  security_level: critical
+  keywords:
+  - bcrypt
+  - hash
+- id: CS-018
+  pattern_name: PasswordHasher
+  description: Identity password hashing
+  library: Microsoft.AspNetCore.Identity
+  security_level: critical
+  keywords:
+  - hash
+  - password
+- id: CS-019
+  pattern_name: Policy-Based Authorization
+  description: Custom authorization policies
+  library: Microsoft.AspNetCore.Authorization
+  security_level: high
+  keywords:
+  - policy
+  - authz
+- id: CS-020
+  pattern_name: Role-Based Authorization
+  description: Role checks for routes
+  library: Microsoft.AspNetCore.Authorization
+  security_level: high
+  keywords:
+  - roles
+  - rbac
+- id: CS-021
+  pattern_name: Claims-Based Identity
+  description: Claims principal handling
+  library: System.Security.Claims
+  security_level: high
+  keywords:
+  - claims
+  - principal
+- id: CS-022
+  pattern_name: AntiForgery
+  description: CSRF protection middleware
+  library: Microsoft.AspNetCore.Antiforgery
+  security_level: critical
+  keywords:
+  - csrf
+  - antiforgery
+- id: CS-023
+  pattern_name: Rate Limiting Middleware
+  description: AspNetCoreRateLimit package
+  library: AspNetCoreRateLimit
+  security_level: high
+  keywords:
+  - ratelimit
+  - api
+- id: CS-024
+  pattern_name: FIDO2 Server
+  description: WebAuthn server library
+  library: Fido2.AspNet
+  security_level: critical
+  keywords:
+  - fido2
+  - webauthn
+- id: CS-025
+  pattern_name: IdentityServer
+  description: OpenID Connect server
+  library: Duende.IdentityServer
+  security_level: high
+  keywords:
+  - oidc
+  - server