Koder id auth coverage

Koder ID Auth — Conformance & Coverage Registry

Tracks which Koder components implement specs/auth/oauth-flow.kmd and run the test template specs/auth/oauth-flow-test-template.kmd across their UI surfaces. Pre-release release engineering MUST verify the row for the releasing component shows green for the enabled surfaces.

Status values:

  • *ASS*— all 12 cases (T1T8 + I1I3 + N1-N4) green
  • *ASS¹*— all 12 cases green *odulo I1-staging SKIP* the wire

    contract is covered by the G1 central oauth-stub and the SKIP is a deployment artifact (G2 — stg.id.koder.dev provisioning) rather than a coverage gap. Promotes to PASS when G2 lands.

  • *ARTIAL*— some cases green, some pending (note which)
  • *AIL*— test template implemented but blocking failure
  • */A*— surface not shipped for this component
  • *ODO*— implementation pending
  • *KIP*— intentionally skipped with rationale

Surfaces

ID Surface Notes
S1 backend server-side, no user UI; auth applies to API consumers
S2 mobile (Flutter) Android + iOS
S3 desktop (Flutter) Linux + macOS + Windows
S4 tv (React TizenOS/WebOS) device auth grant (RFC 8628)
S5 web (Flutter Web or templ+HTMX)
S6 cli (Go cobra) local loopback flow
S7 tui (Bubble Tea) local loopback flow
S8 desktop shell (native, non-Flutter) session-wide auth; Kolide; libsecret storage

Conformance grid

Date is "last audit date" for the row. Update entry when conformance state changes.

Date Component S1 S2 S3 S4 S5 S6 S7 S8 Notes
20260512 products/dev/flow (Koder Flow) (path corrected 20260524 per RFC-003; previously listed as services/foundation/flow) PARTIAL N/A N/A N/A PARTIAL N/A N/A N/A *eference implementation.*Conformance state after 20260512 incident recovery: R1 ✓ (Koder ID sole provider, services/foundation/id OAuth source id=1 active in DB); R2 ✓ (slug renamed KoderID → koder-id kebab via UPDATE login_source SET name='koder-id' WHERE id=1); R3 ✓ (authorize URL constructed correctly, verified via 307 chain from /user/oauth2/koder-id); R4 ✓ (callback handler returns 303 to /dashboard for authenticated session, native Gitea behavior); R5 ✓ (Jet vhost root removed 20260512; / now goes to Gitea proxy → LANDING_PAGE = login → userlogin for anonymous, dashboard for authenticated); R6 ✓ (custom signin.tmpl in `varlibkoderflowcustomtemplatesuserauth/` renders metarefresh + JS redirect to /user/oauth2/koder-id, zero local form); R7 ⚠ (LinkAccountMode preserved in template but not e2e tested); R8 ✓ (Gitea default _koder_sid cookie, scope correct); R9 ⚠ (redirect_to preserve coded in template, not e2e tested). Full T1T8 automated suite PENDING — manual verification in prod 20260512. I1I3 SKIP (G2 staging not provisioned). N1N4 PENDING. *pdate 20260524 (FLOW115 Phase 1)* Structural regression suite landed at products/dev/flow/engine/tests/regression/oauth/ — 4 bash scripts covering R1 (issuer pin), R2 (notypo + migration default), R3+R6+R7 (signin.tmpl invariants). TSUITE coverage map at tests/regression/oauth/T-SUITE-COVERAGE.kmd. CI gate via .koder-flow/workflows/oauth-regression.yml on pathfiltered triggers. Tsuite WIRE half (T2T3T5T8 + N1N3 + I1 via central oauthstub) deferred to FLOW118 — unblocked when G1 oauth-stub lands. Posture remains PARTIAL pending Phase 2.
20260518 services/foundation/id itself SKIP (R1.E1) N/A N/A N/A SKIP (R1.E1) N/A N/A N/A Ddecision closed 20260518 (engine#103): the provider's own administration UIs (`accountui, admin-ui) ride cookie-session direct, NOT OAuth-to-self. Codified as oauthflow.kmd §R1.E1`. Industry norm (Auth0OktaKeycloakEntra all do the same). S1S5 SKIP because the engine processes serve the UI directly inside its own session boundary; running OAuth against the issuer that owns the session backing store would be circular. External RPs (Flow, Kall, Dek, etc.) remain subject to R1+R6+full Tsuite — those rows continue to be audited normally.
20260519 products/horizontal/dek (Koder Dek web) N/A PASS¹ PASS¹ N/A PASS¹ N/A N/A N/A *romoted PARTIAL → PASS¹ on 20260519*after the full integration stack landed across #094 Fase 5 → #115 → #116 → #117 → #118. ¹ = PASS modulo I1staging (G2 still blocks stg.id.koder.dev); the central oauthstub from G1 now covers the wire contract endtoend. Concrete coverage: *T1T4T6value semantics)*`apptestcorerouter/anonymousredirectpolicy_test.dart` (22 cases — anonymousbounce, authenticatedneverbounce, dualstate root, surface gating, bootstrap races, /auth

Source: ../home/koder/dev/koder/meta/docs/stack/registries/koder-id-auth-coverage.md