@nockdev/awf 6.2.0

package/.agent/skills/core/authentication/data/language-go.yaml

@@ -0,0 +1,215 @@
+metadata:
+  skill: authentication
+  domain: language_go
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: language-go.csv
+  patterns_count: 25
+  columns:
+  - id
+  - pattern_name
+  - description
+  - library
+  - security_level
+  - keywords
+patterns:
+- id: GO-001
+  pattern_name: golang-jwt/v5
+  description: Standard JWT library for Go
+  library: golang-jwt/v5
+  security_level: high
+  keywords:
+  - jwt
+  - parsing
+- id: GO-002
+  pattern_name: JWT Signing RS256
+  description: RSA signing with private key
+  library: golang-jwt/v5
+  security_level: high
+  keywords:
+  - rs256
+  - signing
+- id: GO-003
+  pattern_name: JWT Verification
+  description: Validate signature and claims
+  library: golang-jwt/v5
+  security_level: critical
+  keywords:
+  - verify
+  - validate
+- id: GO-004
+  pattern_name: Custom Claims Struct
+  description: Type-safe claims with struct embedding
+  library: golang-jwt/v5
+  security_level: medium
+  keywords:
+  - claims
+  - struct
+- id: GO-005
+  pattern_name: x/oauth2 Package
+  description: Official OAuth2 client library
+  library: golang.org/x/oauth2
+  security_level: high
+  keywords:
+  - oauth2
+  - client
+- id: GO-006
+  pattern_name: OAuth2 Config
+  description: Client ID secret and endpoints
+  library: golang.org/x/oauth2
+  security_level: high
+  keywords:
+  - config
+  - setup
+- id: GO-007
+  pattern_name: Token Source
+  description: Automatic token refresh handling
+  library: golang.org/x/oauth2
+  security_level: high
+  keywords:
+  - refresh
+  - source
+- id: GO-008
+  pattern_name: Authorization Code Flow
+  description: Exchange code for tokens
+  library: golang.org/x/oauth2
+  security_level: high
+  keywords:
+  - authz-code
+  - exchange
+- id: GO-009
+  pattern_name: Goth Multi-Provider
+  description: OAuth for multiple providers
+  library: markbates/goth
+  security_level: medium
+  keywords:
+  - goth
+  - providers
+- id: GO-010
+  pattern_name: Session Store
+  description: Gorilla sessions for state
+  library: gorilla/sessions
+  security_level: high
+  keywords:
+  - sessions
+  - gorilla
+- id: GO-011
+  pattern_name: Secure Cookie Store
+  description: Encrypted cookie sessions
+  library: gorilla/securecookie
+  security_level: high
+  keywords:
+  - cookie
+  - encrypted
+- id: GO-012
+  pattern_name: CSRF Protection
+  description: Gorilla CSRF middleware
+  library: gorilla/csrf
+  security_level: critical
+  keywords:
+  - csrf
+  - middleware
+- id: GO-013
+  pattern_name: Bcrypt Hashing
+  description: Password hashing with bcrypt
+  library: golang.org/x/crypto/bcrypt
+  security_level: critical
+  keywords:
+  - bcrypt
+  - hash
+- id: GO-014
+  pattern_name: Argon2 Hashing
+  description: Memory-hard password hashing
+  library: golang.org/x/crypto/argon2
+  security_level: critical
+  keywords:
+  - argon2
+  - hash
+- id: GO-015
+  pattern_name: Casbin Authorization
+  description: RBAC ABAC policy engine
+  library: casbin/casbin
+  security_level: high
+  keywords:
+  - rbac
+  - casbin
+- id: GO-016
+  pattern_name: JWT Middleware
+  description: HTTP middleware for JWT auth
+  library: custom
+  security_level: high
+  keywords:
+  - middleware
+  - auth
+- id: GO-017
+  pattern_name: Context User Storage
+  description: Store user in request context
+  library: stdlib
+  security_level: medium
+  keywords:
+  - context
+  - user
+- id: GO-018
+  pattern_name: Rate Limiter
+  description: Login attempt rate limiting
+  library: go.uber.org/ratelimit
+  security_level: high
+  keywords:
+  - ratelimit
+  - login
+- id: GO-019
+  pattern_name: Fiber JWT Middleware
+  description: JWT for Fiber framework
+  library: gofiber/jwt
+  security_level: high
+  keywords:
+  - fiber
+  - jwt
+- id: GO-020
+  pattern_name: Gin JWT Middleware
+  description: JWT for Gin framework
+  library: gin-contrib/jwt
+  security_level: high
+  keywords:
+  - gin
+  - jwt
+- id: GO-021
+  pattern_name: Echo JWT Middleware
+  description: JWT for Echo framework
+  library: labstack/echo
+  security_level: high
+  keywords:
+  - echo
+  - jwt
+- id: GO-022
+  pattern_name: Chi Middleware Chain
+  description: Auth middleware for Chi
+  library: go-chi/chi
+  security_level: medium
+  keywords:
+  - chi
+  - middleware
+- id: GO-023
+  pattern_name: PASETO Tokens
+  description: Platform-Agnostic Security Tokens
+  library: o1egl/paseto
+  security_level: high
+  keywords:
+  - paseto
+  - tokens
+- id: GO-024
+  pattern_name: OIDC Client
+  description: OpenID Connect client
+  library: coreos/go-oidc
+  security_level: high
+  keywords:
+  - oidc
+  - openid
+- id: GO-025
+  pattern_name: WebAuthn Server
+  description: Passkey server implementation
+  library: go-webauthn/webauthn
+  security_level: critical
+  keywords:
+  - webauthn
+  - passkey

package/.agent/skills/core/authentication/data/language-java.yaml

@@ -0,0 +1,215 @@
+metadata:
+  skill: authentication
+  domain: language_java
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: language-java.csv
+  patterns_count: 25
+  columns:
+  - id
+  - pattern_name
+  - description
+  - library
+  - security_level
+  - keywords
+patterns:
+- id: JV-001
+  pattern_name: Spring Security Core
+  description: Central Spring authentication framework
+  library: spring-security-core
+  security_level: high
+  keywords:
+  - spring
+  - security
+- id: JV-002
+  pattern_name: SecurityFilterChain
+  description: Component-based security configuration
+  library: spring-security-web
+  security_level: high
+  keywords:
+  - filter
+  - chain
+- id: JV-003
+  pattern_name: AuthenticationManager
+  description: Core authentication handling
+  library: spring-security-core
+  security_level: high
+  keywords:
+  - manager
+  - auth
+- id: JV-004
+  pattern_name: UserDetailsService
+  description: Load user data for authentication
+  library: spring-security-core
+  security_level: high
+  keywords:
+  - user
+  - details
+- id: JV-005
+  pattern_name: PasswordEncoder
+  description: BCrypt password encoding
+  library: spring-security-crypto
+  security_level: critical
+  keywords:
+  - bcrypt
+  - encoder
+- id: JV-006
+  pattern_name: Argon2PasswordEncoder
+  description: Argon2 for Spring Security
+  library: spring-security-crypto
+  security_level: critical
+  keywords:
+  - argon2
+  - encoder
+- id: JV-007
+  pattern_name: JWT Filter
+  description: OncePerRequestFilter for JWT validation
+  library: custom
+  security_level: high
+  keywords:
+  - jwt
+  - filter
+- id: JV-008
+  pattern_name: jjwt Library
+  description: Java JWT creation and parsing
+  library: io.jsonwebtoken
+  security_level: high
+  keywords:
+  - jjwt
+  - jwt
+- id: JV-009
+  pattern_name: Spring OAuth2 Client
+  description: OAuth2 client support
+  library: spring-security-oauth2-client
+  security_level: high
+  keywords:
+  - oauth2
+  - client
+- id: JV-010
+  pattern_name: Spring OAuth2 Resource Server
+  description: JWT resource server
+  library: spring-security-oauth2-resource-server
+  security_level: high
+  keywords:
+  - resource
+  - jwt
+- id: JV-011
+  pattern_name: Spring Authorization Server
+  description: Full OAuth2 server
+  library: spring-authorization-server
+  security_level: high
+  keywords:
+  - authz
+  - server
+- id: JV-012
+  pattern_name: OIDC Support
+  description: OpenID Connect integration
+  library: spring-security-oauth2-client
+  security_level: high
+  keywords:
+  - oidc
+  - openid
+- id: JV-013
+  pattern_name: Method Security
+  description: PreAuthorize PostAuthorize
+  library: spring-security-core
+  security_level: high
+  keywords:
+  - method
+  - annotations
+- id: JV-014
+  pattern_name: CSRF Protection
+  description: CsrfTokenRepository
+  library: spring-security-web
+  security_level: critical
+  keywords:
+  - csrf
+  - token
+- id: JV-015
+  pattern_name: Session Management
+  description: SessionRegistry configuration
+  library: spring-security-core
+  security_level: high
+  keywords:
+  - session
+  - registry
+- id: JV-016
+  pattern_name: Remember Me
+  description: PersistentTokenBasedRememberMeServices
+  library: spring-security-web
+  security_level: medium
+  keywords:
+  - remember
+  - persistent
+- id: JV-017
+  pattern_name: WebAuthn Support
+  description: Spring Security 6.4 passkeys
+  library: spring-security-webauthn
+  security_level: critical
+  keywords:
+  - webauthn
+  - passkey
+- id: JV-018
+  pattern_name: Keycloak Integration
+  description: SSO with Keycloak
+  library: keycloak-spring-boot-starter
+  security_level: high
+  keywords:
+  - keycloak
+  - sso
+- id: JV-019
+  pattern_name: JWT Nimbus
+  description: JOSE JWT implementation
+  library: nimbus-jose-jwt
+  security_level: high
+  keywords:
+  - nimbus
+  - jose
+- id: JV-020
+  pattern_name: Auth0 Spring SDK
+  description: Auth0 integration
+  library: auth0-spring-security-api
+  security_level: high
+  keywords:
+  - auth0
+  - sdk
+- id: JV-021
+  pattern_name: SAML Support
+  description: SAML2 authentication
+  library: spring-security-saml2-service-provider
+  security_level: high
+  keywords:
+  - saml
+  - enterprise
+- id: JV-022
+  pattern_name: LDAP Authentication
+  description: Active Directory integration
+  library: spring-security-ldap
+  security_level: high
+  keywords:
+  - ldap
+  - ad
+- id: JV-023
+  pattern_name: OTP Aerogear
+  description: TOTP implementation
+  library: aerogear-otp-java
+  security_level: high
+  keywords:
+  - totp
+  - otp
+- id: JV-024
+  pattern_name: Java JWT
+  description: Lightweight JWT library
+  library: com.auth0.java-jwt
+  security_level: high
+  keywords:
+  - auth0
+  - jwt
+- id: JV-025
+  pattern_name: Rate Limiter Bucket4j
+  description: Rate limiting for logins
+  library: bucket4j
+  security_level: high
+  keywords:
+  - ratelimit
+  - bucket4j

package/.agent/skills/core/authentication/data/language-mobile.yaml

@@ -0,0 +1,215 @@
+metadata:
+  skill: authentication
+  domain: language_mobile
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: language-mobile.csv
+  patterns_count: 25
+  columns:
+  - id
+  - pattern_name
+  - description
+  - platform
+  - security_level
+  - keywords
+patterns:
+- id: MOB-001
+  pattern_name: Swift AuthenticationServices
+  description: Apple passkeys and Sign in with Apple
+  platform: iOS
+  security_level: critical
+  keywords:
+  - authservices
+  - passkey
+- id: MOB-002
+  pattern_name: Swift Keychain
+  description: Secure credential storage
+  platform: iOS
+  security_level: critical
+  keywords:
+  - keychain
+  - storage
+- id: MOB-003
+  pattern_name: KeychainAccess Library
+  description: Keychain wrapper for Swift
+  platform: iOS
+  security_level: high
+  keywords:
+  - wrapper
+  - keychain
+- id: MOB-004
+  pattern_name: LAContext Biometrics
+  description: Face ID Touch ID authentication
+  platform: iOS
+  security_level: high
+  keywords:
+  - biometric
+  - faceid
+- id: MOB-005
+  pattern_name: ASAuthorizationController
+  description: Passkey creation and authentication
+  platform: iOS
+  security_level: critical
+  keywords:
+  - passkey
+  - controller
+- id: MOB-006
+  pattern_name: Sign in with Apple
+  description: Apple identity provider
+  platform: iOS
+  security_level: high
+  keywords:
+  - siwa
+  - apple
+- id: MOB-007
+  pattern_name: iOS Credential Manager
+  description: Modern credential API iOS 18+
+  platform: iOS
+  security_level: high
+  keywords:
+  - credential
+  - manager
+- id: MOB-008
+  pattern_name: Swift Crypto
+  description: Apple cryptography library
+  platform: iOS
+  security_level: high
+  keywords:
+  - crypto
+  - swift
+- id: MOB-009
+  pattern_name: AppAuth iOS
+  description: OAuth for iOS apps
+  platform: iOS
+  security_level: high
+  keywords:
+  - oauth
+  - appauth
+- id: MOB-010
+  pattern_name: JWT.io Decode Swift
+  description: SwiftJWT library
+  platform: iOS
+  security_level: high
+  keywords:
+  - jwt
+  - swift
+- id: MOB-011
+  pattern_name: Kotlin Firebase Auth
+  description: Google authentication SDK
+  platform: Android
+  security_level: high
+  keywords:
+  - firebase
+  - google
+- id: MOB-012
+  pattern_name: Firebase Email Password
+  description: Traditional email login
+  platform: Android
+  security_level: medium
+  keywords:
+  - email
+  - password
+- id: MOB-013
+  pattern_name: Firebase Google Sign-In
+  description: Google account SSO
+  platform: Android
+  security_level: high
+  keywords:
+  - google
+  - sso
+- id: MOB-014
+  pattern_name: BiometricPrompt API
+  description: Fingerprint face authentication
+  platform: Android
+  security_level: high
+  keywords:
+  - biometric
+  - fingerprint
+- id: MOB-015
+  pattern_name: BiometricManager
+  description: Check device capabilities
+  platform: Android
+  security_level: medium
+  keywords:
+  - manager
+  - capability
+- id: MOB-016
+  pattern_name: Credential Manager API
+  description: Modern Android passkeys
+  platform: Android
+  security_level: critical
+  keywords:
+  - credential
+  - passkey
+- id: MOB-017
+  pattern_name: EncryptedSharedPreferences
+  description: Secure preference storage
+  platform: Android
+  security_level: high
+  keywords:
+  - encrypted
+  - prefs
+- id: MOB-018
+  pattern_name: Android Keystore
+  description: Hardware-backed key storage
+  platform: Android
+  security_level: critical
+  keywords:
+  - keystore
+  - hardware
+- id: MOB-019
+  pattern_name: Play Integrity API
+  description: App attestation (replaces SafetyNet)
+  platform: Android
+  security_level: high
+  keywords:
+  - integrity
+  - attestation
+- id: MOB-020
+  pattern_name: AppAuth Android
+  description: OAuth for Android apps
+  platform: Android
+  security_level: high
+  keywords:
+  - oauth
+  - appauth
+- id: MOB-021
+  pattern_name: JWT Kotlin
+  description: jsonwebtoken-kt library
+  platform: Android
+  security_level: high
+  keywords:
+  - jwt
+  - kotlin
+- id: MOB-022
+  pattern_name: OkHttp Authenticator
+  description: Token refresh interceptor
+  platform: Android
+  security_level: high
+  keywords:
+  - okhttp
+  - refresh
+- id: MOB-023
+  pattern_name: Retrofit Auth Header
+  description: Authorization header injection
+  platform: Android
+  security_level: medium
+  keywords:
+  - retrofit
+  - bearer
+- id: MOB-024
+  pattern_name: Android FIDO2
+  description: Google FIDO2 API
+  platform: Android
+  security_level: critical
+  keywords:
+  - fido2
+  - passkey
+- id: MOB-025
+  pattern_name: Flutter Local Auth
+  description: Biometric plugin
+  platform: Flutter
+  security_level: high
+  keywords:
+  - flutter
+  - biometric