ComplicatedAuth
Menu

Understand / Audit

Implementation status and gaps.

A 23 August 2026 audit and remediation snapshot based on source inspection, database acceptance, dependency audit, typecheck, lint, browser, and production-build results.

13Resolved
2Partial / external
2Open
17Tracked total

Verification snapshot

What passed—and what did not.

A green build is not the same as production readiness. Results below distinguish executable checks from policy and product gaps.

SurfaceCheckResult
OpenAPILint + documentation coverage + bundle116 operations and 130 schemas documented
Go backendUnit + PostgreSQL acceptance, including migrations, idempotency, OAuth/OIDC, Resource Servers, grants, decisions, Support Cases, and revocationPass
Three SDKsTypecheck + Vitest + build8 tests pass; all gates pass
ConsoleTypecheck + lint + production build + browser3 browser flows pass, including identity, delegated OAuth, credentials, and Support Cases
Consolenpm audit0 known vulnerabilities
Next.js exampleTypecheck + env-free buildPass
DocsAstro check + links + accessibility + browserPass
Other JavaScript reposnpm auditNo known vulnerabilities reported

Prioritized register

Seventeen concrete findings.

Each item includes the observed evidence and a completion bar, so the register can become an implementation backlog.

CriticalExternal actionCA-001

The exposed credential file is removed; revocation remains

The untracked root-level plaintext credential file was permanently removed without printing its value. Local deletion cannot invalidate the credential or prove it was never copied.

Evidence · Workspace scan: Secrets.md absent · value remained redacted throughout remediation
Done when: Revoke or rotate the credential in GitHub, review access logs, scan any other copies or history, enable repository secret scanning, and confirm the replacement has least privilege.
CriticalResolvedCA-002

Legacy single-factor session routes were removed

The server no longer registers or publishes password-only and passkey-only session endpoints. Password-verified first-FIDO enrollment now bootstraps new users without creating a password-only session.

Evidence · server.go registered routes · openapi.yaml 116-operation contract · TestLegacySingleFactorRoutesAreNotRegistered
Done when: Completed: negative route tests pass, the generated contract excludes legacy operations, and a dedicated first-enrollment flow covers new users.
HighOpenCA-003

Facial authentication has no liveness or anti-spoofing signal

The adapter sends one selfie to an external template service and accepts a boolean match. It cannot support a spoof-resistance claim.

Evidence · internal/api/biometric_provider.go · README disclosure: single-selfie protocol
Done when: Define provider assurance requirements, liveness evidence, retry and lockout semantics, deletion guarantees, and an end-to-end reference-provider test.
HighResolvedCA-004

The BFF SDK ships a production Redis reference store

RedisReferenceStore accepts the official Redis client surface, uses backend expiry for TTL, rejects malformed records, and shares references across BFF instances.

Evidence · complicatedauth-backend-sdk/src/store.ts · test/store.test.ts · production guide
Done when: Completed: multi-instance continuity, expiry, deletion, and malformed-record behavior are tested and documented.
HighResolvedCA-005

Login throttling is shared across replicas

Console source IPs, console identities, Project login starts, and Project password checks use separate PostgreSQL policies. Records contain keyed digests instead of raw identifiers, counters are capped, windows expire, and authentication fails closed if enforcement is unavailable.

Evidence · internal/store/rate_limits.go + rate_limits_test.go · migration 000004_distributed_rate_limits · server.go + login_flow.go
Done when: Completed: concurrent simulated replicas share one allowance, the sixth of five allowed attempts is denied with retry timing, reset and expiry are verified, and OpenAPI documents 429 and dependency-failure behavior.
HighResolvedCA-014

Console dependency advisories were remediated

Next.js was upgraded to 16.3.1, sharp resolves to 0.35.3, and nanoid is overridden to 3.3.18. npm reports zero known vulnerabilities.

Evidence · complicatedauth-console/package.json + package-lock.json · npm audit → 0 vulnerabilities
Done when: Completed: typecheck, lint, production build, dependency audit, and browser suite are release gates.
HighResolvedCA-015

Migration history and retry ownership are durable across replicas

Startup serializes migration work, seals applied SQL with SHA-256 checksums, and rejects changed or missing history. A PostgreSQL idempotency store coordinates processing leases, request hashes, exact responses, stale owners, retention, and cleanup.

Evidence · internal/store/migrations.go + migrations_test.go · internal/store/idempotency.go + idempotency_test.go · migration 000003_platform_foundations
Done when: Completed: PostgreSQL acceptance runs concurrent migrators, detects changed and removed history, replays exact responses, rejects changed requests, protects against stale completion, and verifies expiry cleanup.
MediumDeployment pendingCA-006

Contract drift is fixed; production hostname is unassigned

Health operations explicitly opt out of global authentication, Project User detail documents passkeys, generated Go and console types are synchronized, and docs CI fails on snapshot drift. Only a real production API server URL remains unavailable.

Evidence · openapi.yaml · generated Go contract · console schema.d.ts · docs check:openapi
Done when: After production infrastructure exists, add its real server URL and verify request examples against that deployment. Do not publish a fabricated hostname.
MediumResolvedCA-007

All three SDK typecheck gates pass

The base TypeScript configurations cover source and tests without an incompatible rootDir, while build configurations still emit src-only packages.

Evidence · Three tsconfig.json files · npm run typecheck → pass
Done when: Completed: typecheck, tests, build, package dry-run, and audit are required in every SDK workflow.
MediumResolvedCA-008

SDK and example repositories now define CI

Each SDK gates locked install, typecheck, tests, build, package dry-run, and audit. The Next example builds without secrets and the framework recipe repository validates its supported examples.

Evidence · Three SDK workflows · next example workflow · integration-examples workflow
Done when: Completed locally; workflows become enforceable after the initial commits are pushed and branch protection is enabled.
MediumResolvedCA-009

The Next.js example loads secrets only at request time

Its dynamic route now initializes ComplicatedAuthServer lazily, so static rendering and production build do not require secret placeholders.

Evidence · lib/auth-server.ts:getComplicatedAuth · env-free npm run build
Done when: Completed: the CI build runs without production credentials and the README documents the runtime boundary.
MediumResolvedCA-010

The integration-examples repository has supported recipes

Remix and SvelteKit BFF recipes use RedisReferenceStore, include threat guidance, and link to the dedicated Next.js example.

Evidence · complicatedauth-integration-examples/{remix,sveltekit,SECURITY.md} · npm run check
Done when: Completed for the declared recipes; add framework-native build smoke tests when the SDK packages are published.
Product gapResolvedCA-011

Tenant Members have verification and recovery lifecycles

Verification and password-reset requests are deliberately non-enumerating and rate limited across replicas. One-time proofs are hashed, prior proofs are invalidated, delivery content is encrypted, and SMTP delivery runs asynchronously through the leased job queue. Password reset revokes console sessions and OAuth artifacts, deletes management WebAuthn credentials, and requires fresh enrollment.

Evidence · migration 000011_tenant_member_recovery · tenant_member_recovery.go · email_delivery.go · four Console authentication operations · verification/reset console pages · PostgreSQL acceptance
Done when: Completed: signup verification, unknown-email parity, emailed invitation proofs, one-time consumption, password replacement, session revocation, old-password rejection, and required post-recovery credential setup are covered by executable acceptance.
Product gapResolvedCA-017

Tenant Member management access requires phishing-resistant authentication

Signup and invitation acceptance create bootstrap sessions with no ordinary management authority. A non-enumerating login attempt verifies the password without creating a session; only user-verified WebAuthn creates strong assurance. Credential metadata is bounded and safe, mutations use ETags, the final authenticator is protected, and registration excludes existing credential identifiers.

Evidence · migration 000013_tenant_member_webauthn · tenant_member_webauthn.go · 11 OpenAPI operations · console setup/account flows · PostgreSQL and Chromium virtual-authenticator acceptance
Done when: Completed: signup bootstrap, route denial, passkey setup, attested USB security-key enrollment, rename/removal concurrency, password-plus-passkey re-login, recovery enrollment, and distinct management/customer RP IDs are exercised.
Product gapResolvedCA-012

Tenant membership has explicit roles and lifecycle

Tenants support owner, admin, developer, support, and viewer roles. API middleware enforces permissions, invitations use one-time tokens and idempotent creation, member disablement revokes sessions, and final-owner invariants are transactionally protected.

Evidence · migration 000005_tenant_memberships · permissions.go + tenant_members.go · OpenAPI Tenant members tag · console /app/team and /app/account
Done when: Completed: PostgreSQL acceptance covers invitation replay and acceptance, viewer denial, role changes, final-owner protection, and session inventory; console typecheck, lint, and production build pass.
Product gapResolvedCA-016

Support Cases have a standalone, integration-neutral contract

Tenant operators manage one inbox while scoped Project service credentials can create and read only their Project's public correspondence. Cases use structured lifecycle fields, ETags, idempotent mutations, encrypted content, constrained attachments, generic external references, immutable events, and explicit retention deadlines.

Evidence · migration 000009_support_cases · support_cases.go and child handlers · OpenAPI Support cases tag · console /app/support-cases · PostgreSQL and browser acceptance
Done when: Completed: cross-Project isolation, visibility boundaries, retry conflicts, attachment encryption, operator-only references, state transitions, retention scheduling, and event filtering are exercised end to end.
LowOpenCA-013

UX and acceptance coverage diverge from the design brief

Origins are folded into Settings rather than a first-class section, and the acceptance flow does not exercise every detailed user-administration or activity-pagination path. Service-account creation, issuance, overlap, scope enforcement, revocation, and disablement are covered.

Evidence · project-console.tsx sections omit origins · full-flow.spec.ts covers the service-account lifecycle but not all user and pagination actions
Done when: Confirm the intended navigation, update the brief or UI, and extend Playwright coverage for the remaining destructive and paginated paths.

Search guides, architecture, SDKs, and the REST API.