mirror of
https://github.com/auth0/agent-skills.git
synced 2026-09-19 02:38:28 +08:00
main
161 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Subhankar Maiti
|
46e17946a3 |
flywheel(feature-mfa): agent-friendly MFA skill references across all SDKs (#219)
* Add per-SDK MFA reference files and min-version column * flywheel(feature-mfa): forbid re-verifying SDK signatures, add vue step-up usage * flywheel(feature-mfa): tell agents to trust per-SDK files and stop verifying * flywheel(feature-mfa): document auth0-auth-js mfa.verify return shape * flywheel(feature-mfa): document nextjs-auth0 redirect step-up flow * flywheel(feature-mfa): fix auth-js/server-js enroll and verify return shapes * flywheel(feature-mfa): fix auth0-server-python mfa_token handling for current beta * flywheel(feature-mfa): close step-up and native-API gaps across remaining SDKs * flywheel(feature-mfa): fix android enroll() return type -- use sealed EnrollmentChallenge base * flywheel(feature-mfa): correct auth0-angular min version and clarify interactiveErrorHandler inheritance * flywheel(feature-mfa): require challengeAuthenticator in challenge path and ban mfaToken in query strings * flywheel(feature-mfa): ban enrollment data in cookies -- only mfaToken belongs in the inter-request store * flywheel(feature-mfa): add afterCallback to express-oidc; ban token exposure + dead-code gap in python * flywheel(feature-mfa): stop agents spelunking -- fix afterCallback session shape and add trust-the-doc notes * flywheel(feature-mfa): add return type shapes and cookie handoff pattern to reduce site-packages spelunking * flywheel(feature-mfa): clarify getAccessToken is the only MfaRequiredError entry point in server-js * flywheel(feature-mfa): fix server-python cookie helper signature and add inline-verify pattern Fix set_cookie example to match scaffold helper (key/value/max_age only — httponly and samesite are always set internally). Add note that verify options should be passed inline (not via a variable) and that verify result may carry a new recovery code on first enrollment. * flywheel(feature-mfa): simplify server-js MfaRequiredError description * flywheel(feature-mfa): ban third-party QR URLs and fix python get_access_token surface * flywheel(feature-mfa): clarify barcode_uri must be returned in enrollment response * flywheel(feature-mfa): address PR review -- popup errors, EMPTY swallow, afterCallback scope, cookie await, verify return, remove Source URLs * fix(lint): remove intra-doc .md references to pass router reachability check |
||
|
sanchitmehtagit
|
f135610540 |
flywheel(feature-mfa): document GET 404 on individual factor endpoints (#214)
* flywheel(feature-mfa): document GET 404 on individual factor endpoints * flywheel(feature-mfa): add correct verify commands inline to prevent GET 404 retries * flywheel(feature-mfa): remove redundant common mistakes row, inline comment is sufficient * flywheel(feature-mfa): reduce verify to single GET guardian/factors to cut step count |
||
|
Kailash B
|
fa56bd580d | feat: Adds auth0-api-js framework reference (#209) | ||
|
Kailash B
|
b4c63e9085 | chore: Adds a row pointing to the auth0-api-js example (#208) | ||
|
sanchitmehtagit
|
114d77ef3c |
flywheel(feature-mfa): add SMS phone sub-endpoints to close mfa_cli score gap (#212)
* fix(feature-mfa): add correct SMS endpoint split for phone MFA configuration The guardian/factors/phone/message-types and guardian/factors/phone/selected-provider endpoints were missing from the tenant config section. Models were attempting to send message_type/provider fields directly to guardian/factors/sms, which returns a 400 error. This caused a ~10pt score drop on the mfa_cli eval for GPT models (luna/terra) that gave up after the 400 without discovering the correct sub-endpoints. - Adds a dedicated SMS section showing the three-endpoint sequence: guardian/factors/sms (enable) → guardian/factors/phone/message-types → guardian/factors/phone/selected-provider → guardian/policies - Adds an email factor CLI example - Moves the OTP/TOTP example to its own labeled subsection - Adds a common-mistakes row for the guardian/factors/sms 400 error * fix(feature-mfa): add Management API v2 reference table with OAS spec link * fix(feature-mfa): simplify tenant config — single code block, drop verbose prose * fix(feature-mfa): scope OAS spec reference to Guardian paths only * fix(feature-mfa): remove external OAS spec link |
||
|
Zachary Balda
|
2a27e746e5 |
feat(auth0): cover the v0 preview in the Vercel tooling reference (#207)
* feat(auth0): cover the v0 preview in the Vercel tooling reference Auth0 login fails in three distinct ways inside the v0 preview, all traceable to the preview running the app in a cross-site iframe on an origin that is neither localhost nor a VERCEL_URL: the SDK redirects to localhost, the state cookie is dropped on the cross-site callback, and the hosted login page refuses to frame. Document all three symptoms with their fixes, plus the dashboard steps for registering the stable v0 preview URL, in the existing Vercel native-integration reference. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix preview URL reference and clarify local dev steps Updated the reference to the preview URL format and added explicit steps for local development configuration. * Update index.md * Update cookie handling instructions for iframe authentication Clarified cookie settings for state management and CSRF protection in iframe scenarios. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Frederik Prijck <frederik.prijck@okta.com> |
||
|
Kailash B
|
7274802552 | chore: Clarify org-login option precedence and org_id validation (#206) | ||
|
Kailash B
|
df772d3950 | chore: Adds generic rules for auth0-auth-js and auth0-server-js (#204) | ||
|
Kailash B
|
84b479887c | Adds auth0-server-js row in examples for Organizations (#203) | ||
|
tusharpandey13
|
bead1ad615 |
feat(auth0): add migrate-node-auth0 skill (#200)
* feat(auth0): add node-auth0 to auth0-auth-js/server-js migration skill Add the migrating-node-auth0-to-auth0-server-js skill plus its behavioral eval case. The skill migrates Auth0 authentication code off the node-auth0 v5 AuthenticationClient onto @auth0/auth0-auth-js (stateless token grants) and @auth0/auth0-server-js (server-managed sessions). - SKILL.md with pre-flight safety (clean-tree check, backup branch, version gating) and a build-until-green verification loop - References: api-mapping, breaking-changes, routing-and-config, server-js-sessions - Scripts: scan-usage.sh, verify-migration.sh - Eval: evals/behavioral/cases/node-auth0-migration.json, 7 cases / 37 graders, reusing the existing run-evals.mjs + graders.mjs (no new grader code) The two server-js cases (routing-session-vs-stateless, server-js-session-traps) are flagged _pending: they depend on per-request options shipping in auth0-auth-js PR #230 and the auth0-server-js mirror #244. The five token-layer cases validate against published auth-js v1.12.0. Dry-run validated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auth0): add container harness + node-auth0 v5 before-fixture Add the migration test harness for the node-auth0 migration skill under evals/behavioral/fixtures/node-auth0-migration/: - before/: a compile-clean TypeScript Express app on node-auth0 v5 (auth0@^5) exercising every pattern the skill migrates plus the traps the evals check: .data envelope reads, snake_case params, relative expires_in arithmetic, req.query.code parsing, AuthApiError/mfa_required string checks, and a ManagementClient usage that must stay put. - Dockerfile: node:20-slim, installs source (auth0@^5) and published target SDKs (@auth0/auth0-auth-js@1.12.0, @auth0/auth0-server-js@1.10.0), copies fixture + skill scripts. - run-loop.sh: build-until-green orchestrator (scan -> [agent rewrite] -> tsc --noEmit -> tests -> verify-migration residue scan). The agent step is gated on MIGRATION_AGENT_CMD (needs claude CLI + Auth0 creds); when unset it is skipped and the residue scan is informational, so the harness runs in CI without creds. - README: build/run instructions and why versions are pinned to published releases (per-request options unreleased, PR #230/#244). Validated locally: fixture tsc --noEmit passes, scan-usage detects all trap patterns, run-loop non-agent path exits green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth0): satisfy skillsaw lint for migration skill - Add metadata.openclaw (emoji, homepage) to the migration skill frontmatter (skill-openclaw-metadata). - Document the skill in plugins/auth0/README.md skills table (skill-readme-documentation). - Drop weak "note that" phrasing in the version-gating step; state the constraint directly (content-weak-language). skillsaw 0.16.0 now reports 0 errors, 0 warnings, grade A. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth0): repair behavioral eval harness + cascade dx-parity skill docs Behavioral eval harness (Road A): the node-auth0-migration case scored 0/48 both with- and without-skill. Root cause was a harness fault, not a skill fault: prompts embedded the "before" code inline, wrote no scaffold to disk, and never told the agent to write a file, so every grader read an empty workspace. Additionally only evals[0] ever ran (48 flat graders against one of 9 scenarios) and judge calls timed out at 60s. - run-evals.mjs: add per-eval scaffold + per-eval workspace loop; shape-detect per-eval vs legacy cases; add --judge-model; dry-run/list/summary handle both shapes. - graders.mjs: raise judge timeout 60s -> 180s; thread optional judge model. - cases/node-auth0-migration.json: restructure 48 flat graders into 9 owning evals; extract inline code into per-eval scaffold; rewrite prompts to "edit in place". - cases/android-migration.json, cases/swift-migration.json: extract inline code to top-level scaffold; keep legacy single-eval shape. - fixtures/node-auth0-migration: container harness + v5 before-fixture updates. - README + EVAL-EXECUTION-FINDINGS.md + ROAD-A-PROGRESS.md: document the per-eval schema, backward-compat rule, and root-cause analysis. Skill docs (dx-parity cascade for auth0-auth-js #248 / auth0-server-js #249): per-request RequestOptions ({signal, headers, customFetch}) and the fullResponse envelope (ApiResponse<T> = {data, response}) shipped in v1.12.1. - breaking-changes.md: add "Reading HTTP response metadata (fullResponse)" with the non-token envelope table, cache-bypass caveat (token methods only), fullResponse-as-literal gotcha, reserved-header and customFetch/mTLS notes; correct the void-methods and header-reads gotchas. - api-mapping.md: success-header opt-in notes on signUp, changePassword, sendEmail/sendSms. - routing-and-config.md: global-config -> per-request options migration, arity rule, type-import note (server-js does not re-export ApiResponse). - SKILL.md: bump target versions to v1.12.1; update the pre-release install note. Skill-only eval run after the fix: node-auth0-migration scores 44/48 (8 of 9 evals perfect, all 5 judge graders pass), up from 0/48. The one remaining failure (leave-management-client) is a grader-regex bug plus an under-specified prompt, tracked separately. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(node-auth0-migration): add 6 evals, real-world run observations Add the six missing eval cases identified in the gap analysis: database-signup-casing, database-changepassword-return, userinfo-claims, pkce-code-verifier, typed-errors-refresh, passwordless-sms-topdown. Case file grows from 9 evals/48 graders to 15 evals/76 graders. Fix three grader/prompt issues found during the skill-only run (74/80): - authorization-code-url prompt now explicitly names getTokenByCode + URL pattern - database-changepassword-return drops the over-broad .data grader - passwordless-sms-topdown drops not_contains loginWithSMS (false-positive on comments) Update userinfo-claims graders and expected_output to accept both tokens.claims (preferred) and authClient.userinfo.getUserInfo() once auth0-auth-js PR #228 lands. Update api-mapping.md UserInfoClient section to document the upcoming authClient.userinfo sub-client (auth0-auth-js v1.12.1+, PR #228). Add pointer in SKILL.md step 3. Add OBSERVATIONS-real-world-run.md: Phase 4 real-world fixture run results. Both with-skill and without-skill correctly migrated all 6 source files. Key finding: skill delta is stylistic for this fixture (model knowledge of auth0-auth-js is already strong); skill adds consistent naming, optional chaining, authorizationParams config pattern. Router gap documented: upgrade-sdk intent does not load migration skill references automatically. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(auth0): wire migrate-node-auth0 intent in router; record Phase 6 results Add `migrate-node-auth0` entry to the auth0 router skill's intent table and section block. The block invokes `migrating-node-auth0-to-auth0-server-js` and loads all three reference files (api-mapping, breaking-changes, routing-and-config). Fixes a gap where `upgrade-sdk` intent never loaded migration references, causing agents to no-op on node-auth0 migration tasks. Also records Phase 6 full with+without eval results in ROAD-A-PROGRESS.md: 76/76 with-skill (100%), skill delta +20 across 15 evals. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(evals): remove session artifacts; revert judgeModel from graders Remove OBSERVATIONS-real-world-run.md, EVAL-EXECUTION-FINDINGS.md, and ROAD-A-PROGRESS.md — these are session analysis artifacts that do not belong in the repo. Add them (plus HANDOFF-*, PROGRESS-LOG-*, ERRORS-*, PLAN-*, run-full-eval.sh, watch-errors.sh) to .gitignore. Revert judgeModel / --judge-model changes from graders.mjs and run-evals.mjs: the separate judge model param was not needed for any eval in this PR and widened the review surface unnecessarily. Judge timeout stays at 60s (original). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(auth0): correct getUserInfo API surface across skill, refs, and evals Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(auth0): router intent name, skillsaw budget, eval graders Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(fixtures): run-loop.sh popd, exit code capture, remove dev paths Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(auth0): trim router SKILL.md under skillsaw budget; add indirect-invocation hint Cut ~40 tokens of prose from auth0/SKILL.md → resolves context-budget warning (4,337 > 4,300). Add indirect-invocation clause to migration skill description per CodeRabbit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(evals): mixed-graders detection, npm-published version guidance, README fence - run-evals.mjs: detect per-eval shape from ANY eval (some), not evals[0] only — a case whose first eval lacked graders was misrouted to the legacy path and returned graded:false without running. - SKILL.md + fixture README: 1.12.1 IS published on npm (current latest) and requires Node 20+; correct the stale 'unreleased' claim. Keep the local-tarball caveat scoped to the per-request RequestOptions/fullResponse surface, which shipped after 1.12.1 and is not in the published tarball yet. - README.md: add 'text' language tag to the layout fence (MD040). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(fixtures): track after/ + agent-rewrite.sh; gitignore vendor tarballs; align version guidance CodeRabbit pushback on two threads: - Dockerfile COPYs after/, agent-rewrite.sh, and vendor/*.tgz, but none were tracked — a root-context build failed on a clean checkout. Track the reference migration (after/) and the harness script; gitignore the 444K prebuilt SDK tarballs (regenerated via npm pack per README) and keep vendor/ with a .gitkeep. README build section now says to populate vendor/ first. - SKILL.md L197-198 still carried the stale 'unreleased on npm' claim that contradicted the corrected pre-flight guidance; aligned both sections. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(fixtures): after/ depends on published auth-js so SCA prescan resolves The SCA (Snyk) lockfile prescan runs 'npm install --package-lock-only' in every package.json dir in the repo, unconditionally (no exclude, no skip). after/package.json had a direct 'file:./vendor/*.tgz' dependency on the gitignored tarball, so the prescan crashed with ENOENT on a clean checkout. Point after/'s dependency at the published '@auth0/auth0-auth-js@^1.12.1' so the manifest resolves from the registry. after/ is a reference-only dir (the Dockerfile builds before/, not after/), so nothing at build time needs the tarball as a direct dep. A Tier-2 compile of after/ — which exercises the post-1.12.1 fullResponse surface absent from published 1.12.1 — overlays the vendored build with an explicit 'npm install ./vendor/...tgz' after the base install; documented in the harness README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(auth0): fold node-auth0 migration skill into auth0 router as nested references (Pattern B) converted the sole Pattern-A sibling skill to Pattern-B nested references matching every merged-PR precedent; moved shared scripts to skills/auth0/scripts; router intent now Read:s the co-loaded refs (removes the sole anomalous Invoke skill: verb); updated eval fixture Dockerfile/agent-rewrite/run-loop paths; trimmed router prose to stay under the 4,300-token skillsaw budget; no reference file exceeds the 1000-line cap so no splitting was required. origin_skill left unchanged (cosmetic provenance). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth0): restore Auth0.Android v4 example; drop unmerged-PR hedge from getUserInfo Address reviewer (kailash-b) feedback on PR #176: - Restore the Auth0.Android v4 example in the upgrade-sdk dispatch block (dropped during the earlier token trim); compressed adjacent prose to stay under the 4,300-token skillsaw budget. - Remove the "when PR #228 merges" hedge from all getUserInfo references (hub + api-mapping). auth0-auth-js#228 lands before this skill PR merges, so getUserInfo is presented as an available AuthClient method. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth0): drop unreleased-API caveats from migration prereqs Remove the "landed after 1.12.1 / not in the published tarball yet / install via local-tarball until the next release" caveat for RequestOptions and fullResponse from both the pre-flight and SDK-versions sections. Same forward-looking basis as the getUserInfo change: the next auth0-auth-js release publishes these APIs before this skill PR merges, so the guide presents them as available rather than pinning to a pre-release install path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth0): address CodeRabbit findings on migration scripts + fixture README - scan-usage.sh / verify-migration.sh: add *.cjs to FILE_GLOBS so CommonJS source files are covered by discovery and residue verification (a migration in a .cjs file no longer slips through undetected). - scan-usage.sh / verify-migration.sh: repoint the reference paths echoed in guidance to the Pattern-B locations (references/migrate-node-auth0-*/index.md); the old flat references/*.md paths were stale after the refactor. - fixture README: fix the local-tarball overlay path — after `cd after`, the sibling vendor dir is `../vendor`, not `./vendor`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth0): use v5 users.list() in migration fixtures (getAll removed in v5) The fixtures declare auth0 ^5.0.0, where UsersClient.getAll was replaced by list(). getAll() does not exist on the v5 ManagementClient, so the harness tsc --noEmit gate would fail on the out-of-scope management code. Switch the before/after fixtures and the inline case snippet to users.list({ per_page: 50 }); list() returns Page<T> with .data, so the .data read is unchanged. The before==after invariant for the out-of-scope function is preserved. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth0): align migrate-node-auth0 refs with conventions; close review gaps Rename the five migrate-node-auth0 reference dirs to the feature- prefix so they match CONTRIBUTING.md's reference-naming convention (feature-/framework-/ tooling-/pattern-); repoint SKILL.md routes and the scan/verify scripts. Add a routing-cases.json case for the migrate-node-auth0 intent so it has coverage like the other Step 4 intents. Narrow scan-usage.sh summary counts to the old node-auth0 method names so a fully migrated after/ fixture no longer reports false positives under MIGRATE (matches verify-migration.sh). Fix the authorization-code-url case assertion (resp.data. -> resp.data) so it fails on the unmigrated scaffold like its nine sibling cases. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor(auth0): migrate-node-auth0 flat co-load → depth-3 leaf group Convert the five flat co-loaded reference files into a proper depth-3 leaf group per docs/architecture.md. The router now emits a single Read to the hub; the hub carries a dependency-ordered dispatch table that loads each leaf at the workflow step that needs it. Proven load order (from leaf dependency audit): routing → breaking-changes → api-mapping → sessions (gated: server-js only) Key correctness fix: breaking-changes now explicitly precedes api-mapping in the dispatch table, with step-3 prose enforcing a single-pass rewrite. Previously this order was implicit and unenforceable; loading api-mapping without breaking-changes pre-loaded causes the expiresAt arithmetic bug and silently skips error-model rewrites. Leanness: stateless auth-js migrations skip sessions.md (210L saved). Router Step-4 shrinks from 5 Reads to 1, restoring 4300-token budget headroom. Reachability checker now passes (was violating sideways-hop rule). Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix(auth0): correct hub step ordering and remove stale co-loaded prose Swap workflow steps 3 and 4 in the hub so prose matches the dispatch table: structural changes (breaking-changes.md) precede method rewrite (api-mapping.md). Remove five stale "co-loaded X reference" phrases left from the flat co-load era. Add inline Read: directive at step 5 for sessions.md. Fix step-number error in architecture doc (breaking-changes is step 3, not step 4). Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix(auth0): fix eval regressions in node-auth0-migration behavioral suite Three behavioral eval failures fixed after leaf-group refactor: **server-js-session-traps (-7 regression):** api-mapping.md mapped oauth.authorizationCodeGrant → getTokenByCode (auth-js only) with no server-js caveat. When sessions.md loaded at step 5 specified completeInteractiveLogin, the competing signals caused the agent to hallucinate handleCallback. Fix: added server-js routing blockquote before the node-auth0 code block and updated the quick-lookup table row to show both paths. **return-shape-and-casing (0/4):** Two causes — skill pre-flight git check blocked on no-git eval workspaces (refuse → warn-and-proceed), and the prompt said "modern SDK" instead of "@auth0/auth0-auth-js" leaving routing ambiguous for the M2M case. **Grader over-specificity (expires-at-absolute, mfa-required-guard, return-shape-and-casing):** Three graders required the literal string tokens.accessToken but agents correctly used destructuring or different variable names. Replaced contains graders with matches graders accepting both direct property access (\w+.accessToken) and const/let destructuring from any getToken* method call. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(auth0): correct node-auth0 version reference v5 → v6 * refactor(auth0): consolidate node-auth0 migration into single framework sink Fold the 5-file feature-migrate-node-auth0 leaf group into a single references/framework-node-auth0/migration.md sink under the node-auth0 framework hub, and relocate the scan/verify oracle scripts to the behavioral fixture dir (the skill now inlines the same commands). Route migrate-node-auth0 through the framework hub; update routing expectations and the architecture docs to match. Apply the CodeRabbit P0/P1/P2 findings and the corrections from a source-verification pass against the target SDKs (@auth0/auth0-auth-js, @auth0/auth0-server-js at >=1.13.0): - open-redirect guard also rejects backslash (browser normalizes \ to /) - custom session stores extend AbstractStateStore/AbstractTransactionStore (SessionStore is a data-adapter interface, not a base class) - residue scan keys on removed-only surface; database.* and passwordless.send* stay valid post-migration and are no longer flagged - getTokenByCode uses codeVerifier only; drop non-existent nonce/maxAge/expectedState and isMfaRequiredError - backchannel loginHint takes { sub }; scope moves to authorizationParams - getAccessToken passes { req, res } as storeOptions (arg 2) - version floor raised to 1.13.0 across guide, fixtures, hub - run-loop.sh stashes the repo before agent rewrite and type-checks only TypeScript projects via tsc --noEmit Gates: reachability PASS, routing PASS (38), skillsaw --strict 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(auth0): address fresh CodeRabbit review on the consolidated migration guide Verify each finding against @auth0/auth0-auth-js / @auth0/auth0-server-js source before applying, then fix: - migration.md: require validating the callback `state` against the stored transaction state before AuthClient.getTokenByCode (CSRF, CWE-352); keep completeInteractiveLogin documented as the server-js path that does this internally - migration.md: drop the redundant revokeRefreshToken call from the logout flow — ServerClient.logout already best-effort-revokes then deletes the session, so the extra call throws MissingSessionError; document revokeRefreshToken for standalone revocation only - migration.md: password grant (ROPC) has no server-js session bridge — document that it stays on auth-js with app-owned session handling - migration.md: split passwordless initiation (startPasswordless, which only sends the OTP/magic link and stores the anti-forgery transaction) from the completion methods that actually persist the session - framework-node-auth0/index.md: correct scope — node-auth0 also ships the stateless AuthenticationClient/UserInfoClient, not "Management-API-only" - verify-migration.sh: residue regex flagged the correct post-migration `e.cause?.error === 'mfa_required'` check; narrow it to the legacy isMfaRequiredError helper only - run-loop.sh: record whether git stash push created a new entry and pop only that ref (reset+clean first), so a pre-existing user stash is never dropped - Dockerfile: document that the unconditional auth-js override in before/package.json breaks the published SDK_SOURCE path on a fresh checkout Gates: reachability PASS, routing PASS (43), skillsaw --strict 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor(auth0): drop node-auth0 migration high-level intent, gate on v6, remove evals from PR Address review feedback on PR #200: - Remove the `migrate-node-auth0` high-level intent from SKILL.md (the intent row and its Step-4 route block). The skill already detects the `auth0` package as the node-auth0 framework and loads framework-node-auth0/index.md; that hub now dispatches to the migration guide. No dedicated top-level intent for a single narrow use-case (per review). - Add a version gate to the migration dispatch in framework-node-auth0/index.md: the guide targets node-auth0 v6, so an app on v4/v5 is turned away with an upgrade message instead of being migrated. Re-narrow migration.md scope to v6 to match. - Remove the migration eval suite from this PR (behavioral case, containerized fixtures, run-evals scaffold, routing case). It moves to the auth0-evals repo; the work remains in this branch's git history. This keeps PR #200 skill-only. - Remove the two migrate-node-auth0 architecture docs flagged as unintended. Gates: reachability PASS, routing PASS (42), skillsaw --strict 0 errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(evals): drop unrelated eval-harness changes from the PR Revert three eval files that rode in from earlier branch commits and are unrelated to the node-auth0 migration skill (and now stale after the eval removal): - cases/android-migration.json — a different skill's migration case - behavioral/.gitignore — generic session-artifact ignores - behavioral/README.md — per-eval runner schema docs whose implementing code was reverted with the eval suite Keeps PR #200 skill-only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: drop orphaned vendor-tarball gitignore rule The rule ignored evals/behavioral/fixtures/node-auth0-migration/vendor/*.tgz, but that fixture dir moved to auth0-evals with the rest of the migration harness. Removing it keeps PR #200 skill-only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(auth0): correct CSRF and passwordless-transaction claims in migration guide Verified against @auth0/auth0-server-js source: - completeInteractiveLogin retrieves the transaction by session id and calls getTokenByCode with codeVerifier/organization only — it does not compare the callback state. Removed the false 'validates the state for you' framing; the guide now requires manual state validation for both getTokenByCode and completeInteractiveLogin, and positions PKCE as code binding, not a state substitute. - startPasswordless stores an anti-forgery transaction only for email magic-link (send: 'link'); SMS-OTP and email-OTP send the code and return with no transaction. Narrowed the initiation note accordingly. Gates: reachability PASS, skillsaw --strict 0 errors (A+). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(auth0): document that buildAuthorizationUrl and buildLogoutUrl are async Both methods perform OIDC discovery and return Promise<...>. Any synchronous caller will silently get a Promise object instead of a URL string. Add an explicit breaking-change callout in the URL-builders section. Discovered during eval run: logout handler had to be made async to await buildLogoutUrl — this wasn't flagged anywhere in the migration guide. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * revert: restore original audit and upgrade-sdk router prose in SKILL.md Revert two unrelated cosmetic edits to the root router that snuck in: - audit section: restore two-sentence form over semicolon join - upgrade-sdk section: restore "Auth0 SDK version bump" and full "is detected" phrasing No behavioral change; gates still green. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor(auth0): strip unrelated SKILL.md edits, keep only node-auth0 router rows Reset SKILL.md to main and re-apply only the three changes this PR owns: - version bump 2.1.2 → 2.2.0 - auth0-auth-js / auth0-server-js rows in the Node package detection table (Step 2) - auth0-auth-js / auth0-server-js rows in the Step 3 intent table All other prose and table edits that crept in from earlier sessions are removed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(auth0): sync SKILL.md to origin/main, drop stale-base regression Previous reset used local main (behind remote). Remote main had gained Python server-python disambiguation, flutter-windows rows, and fastapi variant rows via other merged PRs. This commit restores those and leaves only the three changes this PR owns: version bump, auth0-auth-js / auth0-server-js package-detection rows, and their Step 3 intent rows. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Subhankar Maiti
|
7af36e1206 |
feat(auth0): add framework refs for auth0-auth-js and auth0-server-js (#199)
* feat(auth0): add framework refs for auth0-auth-js and auth0-server-js * docs(auth0): correct auth-js/server-js and mobile ref APIs * docs(auth0): fix buildAuthorizationUrl, getUser, cookie store docs |
||
|
Kailash B
|
294f2260ff |
feat: Adds framework-server-python (#189)
* feat: Adds framework-server-python * feat: Paraphrase to keep instructions more efficient * chore: Address review comments |
||
|
Subhankar Maiti
|
1a29547466 | docs(auth0): flag amr claim filtering in feature-mfa step-up guidance (#201) | ||
|
Kailash B
|
65a5f03485 |
chore: Replaces in-line examples with links to Github repositories (#202)
* chore: Replaces in-line examples with links to Github repositories * chore: Address review comments |
||
|
nandan_prabhu
|
1128024c02 |
feat: Add Auth0 Flutter Windows desktop reference + evals (#192)
* feat: Add Auth0 Flutter Windows desktop reference
auth0_flutter reached Windows GA in v2.1.0 with a distinct API
(windowsWebAuthentication(), custom URL scheme + Registry protocol
handler, no CredentialsManager) that neither the existing
flutter-native (iOS/Android) nor flutter-web references cover.
- Add references/framework-flutter-windows/index.md, verified against
auth0/auth0-flutter's raw README/FAQ/EXAMPLES and example runner
source (vcpkg setup, CMakeLists toolchain wiring, Registry scheme
registration, main.cpp mutex/named-pipe integration, manual
credential storage).
- Wire flutter-windows into SKILL.md's Tier 1/2/3 router tables and
cross-link it from framework-flutter-native/-web's "When NOT to Use".
- Add flutter-windows to validate-skill.sh's EXPECTED_FRAMEWORKS and
the root README coverage table.
- Add routing, activation, and behavioral eval coverage for the new
reference.
* fix: trim SKILL.md prose to stay under skillsaw's context-budget warn limit
The flutter-windows router wiring pushed SKILL.md's estimated token count
over skillsaw's 4,300 warn threshold. Drop the added explanatory prose
(a lead-in sentence and a callout note) and keep only the three backticked
table rows needed for routing/reachability, matching the terse,
table-only convention most other framework rows already use.
* fix: trim SKILL.md prose to stay under skillsaw's context-budget warn limit
CI flagged 4,305 tokens against the 4,300 warn limit after the flutter-windows
rebase. Shortened five prose passages without touching rules or tables.
* fix: address CodeRabbit review findings on Flutter Windows reference
- Split the weak appCustomURL grader into separate login()/logout() call-shape
checks and add Info.plist to the forbidden mobile-only list.
- Require an explicit Windows-target signal before routing to flutter-windows,
since flutter create scaffolds windows/ alongside every other platform dir.
- Derive the single-instance mutex and named-pipe names from the app's custom
scheme instead of a fixed string shared by every app using the example runner.
- Implement real credential persistence (save/restore/clear via
shared_preferences) in the AuthService example instead of leaving TODOs.
- Validate the OAuth state parameter server-side in the /callback handler
before forwarding to the custom scheme.
* fix Flutter Windows router and callback follow-ups
Co-authored-by: sanchitmehtagit <246215521+sanchitmehtagit@users.noreply.github.com>
* fix: address remaining CodeRabbit and human-reviewer findings
- Remove duplicate H1 heading in framework-flutter-windows/index.md
- Replace assert() with ArgumentError for the redirectUrl/returnTo
pairing check, since assert() is stripped from production builds
- Widen the login()/logout() implementation-check regexes so they
also match the receiver-variable style (webAuth.login(...)) used
by the reference's own AuthService example, not just direct chaining
- Scope the intermediary eval's appCustomURL/redirectUrl/returnTo
graders to the correct login()/logout() call instead of matching
those tokens anywhere in the output
* fix: address remaining CodeRabbit findings on Flutter Windows reference
- Check credential expiry before restoring a session
- Guarantee local cleanup in logout() via try/finally, and surface
remote logout failures at the call site
- Actually invoke restoreSession() on startup with a loading gate
- URL-encode code/state/error before redirecting in the /callback handler
- Fix MD031 blank lines around two fenced code blocks
- De-conflate the fw-flutter-windows activation case from generic Auth0 intent
* fix: address latest CodeRabbit review round on Flutter Windows reference
- Replace shared_preferences with flutter_secure_storage for Credentials
persistence (CWE-922: refresh token via offline_access must not be
stored in plaintext)
- Handle malformed/outdated persisted credential records in
restoreSession() instead of leaving the app stuck on the loading screen
- Bind login()/logout() eval graders to the windowsWebAuthentication()
receiver so an unrelated .login()/.logout() call can no longer
false-pass the grader
* revert: restore SKILL.md prose trimmed for since-raised context-budget limit
|
||
|
Subhankar Maiti
|
d33e1b8ca8 |
refactor(auth0): make feature-mfa the single source for MFA (#198)
* refactor(auth0): make feature-mfa the single source for MFA * chore(auth0): bump auth0 skill to 2.1.2 |
||
|
Prince Mathew
|
507b2d67cb |
feat: add Auth0 Kotlin Multiplatform (KMP) SDK skill reference + evals (#188)
* feat: Added new quickstart skill for auth0-kmp sdk * Added evals for the new kmp-skill * Updted the skill post the testing feedback * addressed review comments from @coderabbitai * Reverted the KMP routing to the original one to be in the token limit * addressed review comments from @coderabbitai * Reverted the KMP routing to the original one to be in the token limit * Addressed few more review comments from @coderabbitai |
||
|
sanchitmehtagit
|
5885743688 |
chore: increase context-budget warn limit to 5000 lines (#197)
SKILL.md router grows as new intents/frameworks are added; the 4300-line warn threshold was triggering on legitimate router growth. Raise warn to 5000 (error ceiling stays at 6000). |
||
|
Bharath Natarajan
|
3f09c5f5af |
Complete the OpenAI/Codex plugin listing metadata (#196)
- Sync root plugin.json and .codex-plugin/plugin.json description, homepage, and keywords so the richer, framework-specific listing copy isn't dropped when the marketplace normalizes the Codex manifest from the root Agent Plugins manifest. - Add missing keywords (authentication, authorization, oauth, oidc, sso, rbac) that the descriptions already advertise. - Bump both manifests to 2.1.1 to match SKILL.md's metadata.version, which had drifted ahead after #195. - Add interface.composerIcon, interface.logo (Auth0's official black shield mark, squared on a white background), and interface.brandColor (#EB5424) so the listing isn't missing its icon/logo. - Add interface.defaultPrompt starter prompts for the ChatGPT composer. |
||
|
Bharath Natarajan
|
54fada6741 |
Fix OpenAI plugin submission errors for the auth0 plugin (#193)
* Fix OpenAI plugin submission errors for the auth0 plugin - Codex interface category was "Developer tools" (lowercase "tools"), but OpenAI's Agent Plugins schema requires the exact enum value "Developer Tools" — fixes the "Unsupported plugin category" error. - Add plugins/auth0/skills/auth0/agents/openai.yaml with the skill's interface config (display_name, short_description, default_prompt), since OpenAI's submission checker doesn't read interface settings from SKILL.md metadata — fixes "Skill interface settings must use agents/openai.yaml". - Allow an agents/ directory in skill roots in the custom skill-directory-structure skillsaw rule, since that's where the Agent Plugins spec expects per-skill client config to live. * Address review comments - Fix the same category casing bug in .agents/plugins/marketplace.json (CodeRabbit caught this second occurrence; the earlier fix only covered plugins/auth0/.codex-plugin/plugin.json). - Make SkillDirectoryStructureRule.ALLOWED_DIRS a frozenset so it can't be mutated across instances (CodeRabbit). - Exempt agents/openai.yaml from the agentskill-unreferenced-files check, same as the existing scripts/validate-skill.sh exemption — it's Codex-facing config, not router-linked content (skillsaw CI). * Use reviewer-suggested short_description for the Codex interface More specific than the placeholder — names the concrete capabilities (MFA, SSO, RBAC, Organizations, custom domains, Universal Login) and framework breadth instead of a generic one-liner. * Add agents/openai.yaml to the docs/openai-plugin.md package layout tree The Package layout diagram still only showed SKILL.md, so it no longer matched what the plugin ships now. |
||
|
Subhankar Maiti
|
aa1b11d516 |
feat(mfa): update and expand SDK example links (#195)
* feat(mfa): update and expand SDK example links * feat(mfa): add MFA section rows for react, vue, and angular SDKs * chore: bump skill version to 2.2.0 * chore: bump skill version to 2.1.1 * feat(mfa): label paired SDK rows and use whole file for dedicated example files * fix(mfa): clarify row-selection instruction for SDKs with multiple flow rows * fix(mfa): default to step-up row when SDK supports both flows |
||
|
Kailash B
|
0cba2ea533 | feat: adds a feature/node-auth0 reference for node-auth0 SDK integration (#194) | ||
|
Kailash B
|
89748481a1 | chore: Adds examples entry for auth0-server-python in feature/mfa (#191) | ||
|
Kailash B
|
7af37fe227 |
feat: Rewrites MFA skill to adhere to latest skills convention (#187)
* feat: Modify mfa feature guidance to match the new standard * feat: Add more instructions on id_token decoding amr check * feat: Rephrase steps as bullet points * feat: Adds strict instructions * feat: Make URLs agent-friendly * feat: Address review comments * feat: Improve MFA API instructions * feat: Adds instuctions for enrollment type * feat: Use Briefer instructions wherever possible |
||
|
sanchitmehtagit
|
2d6185dd17 | chore: remove author-auth0-skill from .claude/skills (#186) | ||
|
Kailash B
|
c63de496d5 | feat: Adds guidance on where to get org_id from (#184) | ||
|
Kailash B
|
d6c7f9eca2 | feat: Adds specific guidance on handling invitation and organization params (#182) | ||
|
Kunal Dawar
|
09a0d450c1 |
fix(auth0): correct CLI examples and document agent mode (#180)
* fix(auth0): correct CLI examples and document agent mode The tooling-cli reference told agents to append --json to every command. That is wrong for `auth0 api`, which returns JSON by design and rejects the flag, and for the 63 runnable commands that never define it. Replace the blanket advice with agent-mode guidance and an output-flag table, and fix the invalid commands and flags found across the reference set. * fix(auth0): address review findings on CLI examples Target the branding copy workflow with per-call --tenant. It previously relied on an environment variable the CLI does not read, so both halves hit the active tenant and the import overwrote the tenant just exported from. Patch the target's existing default theme instead of POSTing a payload that still carries themeId. Use headless auth0 login --no-input in the SPA guides rather than machine login with credentials a SPA does not have. Drop the stale redirect-stderr wording and the pipe-separated flag values. * fix(auth0): fail closed in the branding copy script A failed export left the variable empty, which the guards read as an absent resource, so the copy silently completed as a partial. Add set -euo pipefail so a failed export or write aborts, and mark only the genuinely optional lookups with || true. * fix(auth0): correct invalid CLI commands surfaced by evals Running the auth0-evals suite against real tenants turned up commands in the reference files that fail outright, and several models followed them verbatim without recovering. - feature-mfa: guardian/policies takes PUT, not PATCH. PATCH and POST both 404 there, which one model worked around by enforcing MFA through a post-login Action instead of the tenant policy. - feature-organizations: membership, org-scoped roles, and enabling a connection have no dedicated orgs subcommand, so route them through auth0 api post organizations/... Also documents the two invitation prerequisites (organization_usage on the app, an https default_redirection_uri on the tenant) and the --send-email default. - Drop the invalid /api/v2/ prefix from auth0 api paths in feature-organizations and pattern-rate-limiting. - tooling-cli: add value syntax rules (comma-joined lists, = form for booleans), the wrong-verb 404 heuristic, the bare-array response note, a warning against piping 2>&1 into jq, and the Management API OpenAPI spec as the authoritative source for paths and methods. Guidance describes the route that works rather than listing subcommands that are absent, so it does not go stale as the CLI grows. * fix(auth0): enable connections for apps via the clients endpoint The four framework references read enabled_clients off the connection object and patched the merged array back. That field is absent from GET responses on this API version, so the read produced an empty list and the write would have unenabled every other app on the connection. Use PATCH connections/<id>/clients, which only touches the client_id it is given. Also document finding or reusing a database connection in the organizations reference, since an org with no enabled connection cannot be logged into. * fix(auth0): correct remediation command table and drop redundant stderr redirects Fix invalid CLI commands in the audit-remediation table (tenant-settings, universal-login, connections have no PATCH/delete first-class command) and add the ones that actually exist but were marked (none) (network-acl, universal-login prompts update). Also drop 2>&1 before piping to jq/files across a few framework references, since it was swallowing the real error in favor of a jq parse error. * fix(auth0): address remaining PR review findings Fix MFA policy/factor ordering claims, arbitrary connection selection and missing org-connection-enable step in organizations, a grep pattern that never matches the CLI's pretty-printed JSON in framework-android, dangling CONNECTION_ID across swift/ionic-angular/expo, predictable temp file paths in swift, a broken regex-based API existence check in framework-go, and /api/v2/-prefixed paths in the audit-remediation fallback table that 404 against the real auth0 api command. * fix(auth0): stop hardcoding CLI flag-coverage counts that drift with releases |
||
|
sanchitmehtagit
|
2a16d4840c |
feat: restore author-auth0-skill with metadata.internal (#179)
* feat: restore author-auth0-skill contributor skill Reverts the revert in #178 — re-adds the .claude/skills/author-auth0-skill/SKILL.md contributor skill and the AGENTS.md reference that points contributors to it. * feat: add metadata.internal to author-auth0-skill Marks the contributor skill as internal so it is hidden from normal discovery and only visible when INSTALL_INTERNAL_SKILLS=1 is set. |
||
|
Frederik Prijck
|
2bd167a324 |
Revert "feat: add author-auth0-skill contributor skill (#140)" (#178)
This reverts commit
|
||
|
Bharath Natarajan
|
abab92beb4 | feat(auth0): add Agent Plugins manifest (#175) | ||
|
sanchitmehtagit
|
ff9618bb14 | chore(auth0): bump version to 2.1.0 (#174) | ||
|
Bharath Natarajan
|
4204dca0dd |
feat(auth0): add Vercel integration reference (#172)
* feat(auth0): add Vercel integration reference * chore(auth0): drop first-party URL ignores now split into #173 The auth0.com/pricing.md, auth0-oidc-client-net, and auth0-java-mvc-common W012 ignore entries are unrelated to the Vercel integration and are being added separately in #173. Remove them here to keep this PR scoped to Vercel. * fix: address PR review comments * fix: address PR review comments --------- Co-authored-by: Sanchit Mehta <sanchit.mehta@okta.com> |
||
|
Bharath Natarajan
|
9b2f0036ed |
feat(auth0): add Universal Portals guidance (#171)
* feat(auth0): add Universal Portals guidance * fix(auth0): preserve router activation cues * fix(auth0): keep router within context budget * fix(auth0): simplify design inputs checklist in Universal Portals Collapsed items 2–4 into two items: removed the separate portal type entry and merged component selection with its guidance, renumbering the remaining items. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix(auth0): fix markdown formatting in Universal Portals router block Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix(auth0): remove /api/v2/ prefix from auth0 api CLI commands auth0 api resolves against the Management API base automatically; only the path after /api/v2/ is needed. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Resolve description conflict against main: keep main's crisp phrasing, add Universal Portals mention only - Revert unintended Step 2/3 copy-edits to match main - Fix stale /api/v2/ prefix in Universal Portals workflow table * fix(auth0): keep SKILL.md router under context budget The Universal Portals intent row + Step 4 block pushed SKILL.md to 4,105 tokens, over skillsaw's 4,100 warn limit. Trim the new block to match sibling blocks (drop the redundant beta line, already stated in the reference), tighten the intent row, and compress duplicated first-match/Ionic/PHP notes elsewhere in Step 2. Now 4,100, skillsaw clean. --------- Co-authored-by: Jacobo Vidal <jacobo.vidal@okta.com> Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Sanchit Mehta <sanchit.mehta@okta.com> |
||
|
Bharath Natarajan
|
b7d5f82c3f |
feat: package Auth0 skill for Codex plugins (#167)
* feat: package Auth0 skill for Codex plugins * fix: use Auth0 marketplace display name * docs: address review feedback on the Codex packaging The Codex manifest carried a generic one-liner while the Claude and Cursor manifests list the frameworks and features, so directory search for "Next.js" or "MFA" would not have matched this listing. Reuse the marketplace copy for both `description` and `interface.longDescription`. Also drop the "Method N" numbering now that there are four install paths and the newest one sat above the recommended path, sort `.agents/` into the directory tree, and list both docs/ files in the tree and in AGENTS.md. * docs: describe the Codex marketplace as tracking main, not local The marketplace entry resolves plugins/auth0 from the published main branch, so calling it "local testing" was wrong — an uncommitted working tree is not what gets installed. Reword the four places that claimed it and note that changes need pushing before reinstalling. --------- Co-authored-by: Subhankar Maiti <35273200+subhankarmaiti@users.noreply.github.com> Co-authored-by: Subhankar Maiti <subhankar.maiti@okta.com> |
||
|
Frederik Prijck
|
fe3d7c59d9 |
Simplify the skill description, and add an activation eval layer that can prove it (#166)
* test(evals): add skill-activation eval layer for the SKILL.md description
The `description` frontmatter is the only signal an agent uses to decide
whether to load this skill, and no existing eval layer reads it:
- scripts/check_routing_evals.py parses the SKILL.md *body* (Step 4 table)
- evals/behavioral/ loads the plugin via --plugin-dir and grades the code
produced *after* the skill is already in play
So a description edit could destroy discoverability with every other check
green. This adds evals/activation/ to close that gap.
Two stages, both manual-run (they need a live model, like behavioral/):
Stage A (default) renders a realistic skill menu — auth0 plus seven
distractor skills, name + description only — and asks which skills would
be invoked. Cheap, and the description is the only variable between runs.
The distractors matter: asking "would you invoke auth0?" in isolation
primes YES and makes negative cases meaningless. Several distractors are
auth-adjacent (kubernetes-ops, api-hardening, aws-infra) so the near-miss
negatives have a correct home to go to.
Stage B (--real) is ground truth: two temp plugin copies differing only in
the description line, run under --plugin-dir with stream-json, detecting an
actual Skill(auth0) tool call in the event stream rather than prose about
using it.
Variants resolve as `git:<ref>` or a path, so any future description edit is
testable against the same matrix with no new fixtures. Majority vote over
--trials (default 3); cases whose trials disagree report UNSTABLE rather than
being silently rounded.
The 35 cases are built to attack generalized phrasing: keyword-loss prompts,
framework-only prompts, indirect prompts naming no product or feature, and
negatives — including near-misses that deliberately reuse auth vocabulary
(Kubernetes RBAC, application-level 429s, CORS headers on Express, rotating
AWS IAM keys, express-session to Redis). Without those, a description reading
"use this always" scores 100% recall and the suite proves nothing.
README.md records the calibration honestly, including a measured limitation:
Stage A's recall axis catches an under-triggering description (a deliberately
narrow control scored 0/26) but its precision axis is insensitive (a
deliberately broad control still produced 0/9 false positives). A green Stage
A run is therefore evidence against under-triggering only.
* fix(auth0): simplify the skill description and cut keyword lists
The description had grown to 754 characters, most of it literal enumeration:
every supported framework, every named competitor, and a list of specific
error conditions (401, CORS error, callback URL mismatch, 429 rate limit).
AGENTS.md warns against exactly this — keyword dumps instead of user intent.
Replace the enumerations with the intent they were standing in for, keep
Auth0 named explicitly, and add the configuration axis the old wording
missed ("using or configuring any Auth0 feature") with a short representative
sample rather than an exhaustive list. 754 -> 503 characters.
Measured with the new evals/activation/ layer over 35 cases, comparing this
wording against the previous one:
Stage A (classifier, 3 trials): 26/26 recall and 0/9 false positives for
both variants — no regression, but a tie at ceiling, so uninformative on
its own. See the calibration section in evals/activation/README.md.
Stage B (real --plugin-dir activation, 3 trials) is where the difference
showed. The new wording was never worse on any trial, and fixed a real
over-trigger:
kw-passkeys activate old 0/3 new 1/3
indirect-node-api activate old 0/3 new 2/3
neg-cors-headers DON'T old 2/3 new 0/3
The old description fired on a plain "add CORS headers to my Express
server" request two times out of three, because it listed `CORS error` and
`Express` as literal triggers — the keyword-matching failure mode, caught
in the act.
Separately worth noting: real-path recall is low for *both* descriptions
(0-2 of 3 trials). The agent often answers an auth question without loading
the skill at all. That predates this change and is tracked as its own
discoverability problem, not addressed here.
The framework and competitor lists remain in .claude-plugin/marketplace.json
and .cursor-plugin/marketplace.json, where they serve marketplace keyword
search; only the agent-facing activation signal changed.
* refactor(auth0): simplify skill description
Drop inferable keyword lists (framework names, migration sources, error
codes) that the model already generalizes from generic auth phrasing and
that measurably cause over-triggering. Keep the tenant audit/health/plan-fit
(CheckMate) capability as a concept, since it can't be inferred. 956 -> 563
chars, still under the 1024 limit.
* fix(activation-evals): run Stage B over --trials and validate the flag
Stage B previously invoked each variant exactly once, ignoring --trials, so a
REGRESSED/IMPROVED verdict on the only discriminating layer could hinge on one
nondeterministic agent run. Wrap it in realActivationWithTrials with the same
majority-vote + UNSTABLE semantics as classifyWithTrials. Also reject
non-integer or <1 --trials up front, instead of silently running zero/garbage
trials. Addresses CodeRabbit review on PR #166.
---------
Co-authored-by: Sanchit Mehta <sanchit.mehta@okta.com>
|
||
|
Bharath Natarajan
|
8f4ad9dcd7 |
docs: direct contributors to author-auth0-skill (#170)
* docs: direct contributors to authoring skill * ci: allow Auth0 pricing source in skill scan * docs: fix frontmatter pointers and move the capability section up AGENTS.md claimed CONTRIBUTING.md was authoritative for required frontmatter and pointed at it for the ClawHub requires/os/install example, but that section was removed here. Point the example at the skill's own frontmatter instead and scope the CONTRIBUTING.md bullet to what it actually covers. Also move "Adding a Capability to the Unified Skill" above "Local Development" so the two forward references to it don't land after "Questions?". * docs: create the skills dir before copying, pad the nested fence `cp -r ... ~/.claude/skills/` fails when `.claude` itself doesn't exist, which is the case on a machine that has never run Claude Code. Add `mkdir -p` ahead of it and put blank lines around the nested fence so it renders inside the list item. --------- Co-authored-by: Subhankar Maiti <subhankar.maiti@okta.com> |
||
|
sanchitmehtagit
|
163ae6309f |
chore(auth0): ignore first-party Auth0 URL W012 findings (#173)
Add snyk-agent-scan ignores for three first-party Auth0 URLs the skill legitimately references: - https://auth0.com/pricing.md (pricing/healthcheck references fetch live published prices instead of hardcoding them) - https://github.com/auth0/auth0-oidc-client-net (WinForms/MAUI/.NET guidance resolves the current release version) - https://github.com/auth0/auth0-java-mvc-common (Java MVC guidance resolves the current release version) Split out of #172 (Vercel integration), which is unrelated. |
||
|
Subhankar Maiti
|
04f746a0fb |
fix(auth0): correct credential handling and callback scheme in the mobile skills (#168)
* fix(auth0): stop teaching hardcoded credentials in the Expo skill
The Expo reference put domain/clientId literals directly into Auth0Provider
props at seven sites, so agents following it wrote the client ID into App.tsx.
Switch them to EXPO_PUBLIC_* process.env reads and add a .env step, matching
what the React Native reference already does. The app.json plugin keeps literal
values — the domain isn't a secret and the plugin is read at prebuild time.
Also make build verification proportionate. Expo prescribed a prebuild plus
run:ios/run:android with a 5-6 iteration fix loop; that's minutes of work and a
toolchain the environment may not have. Prefer a typecheck and escalate only
when asked. Android and Swift keep their builds but now skip them when no
toolchain is present.
Adds a "Files to Change" table and marks the useAuth0 surface authoritative for
both mobile references, so agents stop reading node_modules to confirm the API.
* fix(auth0): forbid literal credential fallbacks in mobile skills
An eval run showed agents writing process.env.X ?? 'real-client-id' into a
config module, which puts the credential straight back into source and fails a
secret-in-source check. The Expo reference still demonstrated that pattern in
its app.config.js example, so spell out the rule at both the .env step and the
secret-management section, and say the fallback form is the thing to avoid.
Also document how the iOS/Android callback scheme is derived from the bundle
id. Agents were reading the SDK's Swift, Kotlin and TypeScript internals to
reconstruct it — around 18 tool calls per run spent inside node_modules.
* fix(auth0): correct the Android auth0Scheme in the React Native skill
The skill told agents to set auth0Scheme to a bare ${applicationId}. The SDK
appends its own suffix (APPLICATION_ID_SUFFIX = '.auth0'), so the scheme must be
${applicationId}.auth0 — with the bare form the redirect never resolves. Fixed
in the manifestPlaceholders block, the manual RedirectActivity fallback, the
Setup Guide, and the callback-URL derivation table.
The Setup Guide also only documented the manual AndroidManifest edit; it now
leads with manifestPlaceholders to match the Quick Start.
* fix(auth0): address review feedback on the mobile skills
- Skip the Android build only when none of ANDROID_HOME, ANDROID_SDK_ROOT or an
sdk.dir entry in local.properties is present. Checking ANDROID_HOME alone
could skip a usable Gradle build.
- Pick the iOS simulator from `xcrun simctl list devices available` instead of
assuming an iPhone 16 is installed, and pass OS=latest.
- Commit to react-native-dotenv as the documented loader, since every example
reads process.env. react-native-config exposes values on a Config object, so
the previous "either loader" wording described code that would not work.
- Say plainly that `!` is erased at compile time and checks nothing at runtime;
show an explicit throw for callers who want to fail fast.
- Soften "Files to Change" to a starting scope. The paths are not universal —
expo-router roots the provider in app/_layout.tsx and the iOS target
directory name varies — so agents must confirm the entry point before editing.
- Split verification into source and native configuration. A typecheck proves
nothing about plugin application, manifest placeholders or URL schemes, so
list the native values to read back and keep only the device run optional.
Also adds the blank blockquote lines MD031 wants around the fences in the
verification blocks these changes touch.
* revert(auth0): leave the Android and Swift references unchanged
Both files are back to their state on main. The build-verification tweaks there
were incidental to this PR, which is about the Expo and React Native mobile
skills — keeping them out limits the review surface to the frameworks the
mobile quickstart evals actually exercise.
|
||
|
Frederik Prijck
|
90e9c68e0b |
feat(auth0): add plan-aware tenant health check with two-score reporting (#142)
* feat(auth0): fold plan-aware health check into the unified skill
Add a 'healthcheck' intent to the unified auth0 router that assesses an
Auth0 tenant across all plans (Free/Essentials/Professional/Enterprise),
emits two scores (security & config hygiene + capability fit), and
recommends a self-service plan or an 'Enterprise - contact sales' path.
- SKILL.md: Step 1 intent row + Step 4 load block; extend the description.
- references/feature-healthcheck.md: use-case detection, two-score model,
feature-unlock matrix, plan-matching + Enterprise gate, MAU forecast,
Talk-to-Sales brief. Reuses the co-loaded audit workflow, pricing, and
remediation references (the audit runs first to supply findings/context).
- assets/healthcheck/report-template.{md,html}.
- Routing eval (healthcheck-all-plans) + README coverage.
Stacked on the audit intent.
* fix(auth0): restore fix-dependency/prerequisite ordering in remediation reference
feature-healthcheck.md points to the co-loaded remediation reference for
fix-dependency ordering, but that section was dropped in the fold from the
standalone healthcheck skill (old remediation-command-map.md). Restore it:
SMTP-before-Email-MFA, DNS-before-custom-domain, deliverable-factor-before-
MFA-enforce, and connection-before-SSO. Benefits the audit apply loop too.
* chore(auth0): keep skillsaw 0.16.0 green for the new audit/healthcheck intents
The 0.16.0 linter (pulled in from main, #139) adds two rules the folded
intents trip:
- context-budget: two new intents (table row + Step 4 loader each) push the
router body ~50 tokens over the 4000 warn limit. Trimmed the new intent rows
and description, and raised the body warn limit to 4100 (error ceiling still
6000) — routers grow as intents are added.
- content-critical-position: feature-audit.md / feature-healthcheck.md use
CRITICAL/REQUIRED/MUST as literal feature-gap severity values in scoring
tables, which the heuristic misreads as stranded mid-file instructions.
Excluded ONLY those two files; the rule stays active (warning) everywhere else.
* test(auth0): port healthcheck behavioral eval into consolidated harness
Restores the behavioral coverage that shipped with the standalone
auth0-healthcheck-all-plans skill (#127) as evals/behavioral/cases/healthcheck.json,
matching the repo-root consolidated harness. Expectations-only, like the other
interactive-flow cases (branding, cli, acul).
* test(auth0): point healthcheck skill_name at the unified skill
skill_name is the skill under test, which is now auth0 — the standalone
auth0-healthcheck-all-plans skill no longer exists. origin_skill keeps the
pre-migration name so run-evals.mjs can still print "was <origin_skill>",
matching every other case file.
Extend the no-machine-graders note to cover healthcheck (same out-of-workspace
artifact problem as audit) and refresh the case counts (18 -> 19, 5 -> 6).
* refactor(auth0): take health-check prices from the live pricing page
Follows the pricing reference no longer vendoring dollar amounts. The health
check is the workflow that actually quotes prices (the audit emits plan name
only), so it needs the live source wired through:
- Source-of-truth rules and the reference header now split feature availability
(co-loaded reference) from prices (fetched from auth0.com/pricing.md), instead
of pointing both at a file that no longer holds figures.
- Pricing-data-consistency rule now fetches once and reads every figure from
that single response, with an explicit "don't mix figures across fetches or
interpolate between MAU tiers" constraint. A4AA cost is cross-checked against
the fetched A4AA table rather than trusting the x1.5 arithmetic alone.
- Removed the two hardcoded worked examples ($300 base + $150 A4AA = $450 at 1k
MAU, and the same figures in the plan-recommendation JSON sample). Those were
the exact numbers most likely to be quoted verbatim once stale; the JSON
sample now shows <base>/<a4aa>/<total> placeholders.
- The M2M threshold no longer hardcodes "exceeds 5,000" — the included allowance
is itself a published number, so read it from the fetched table.
Also update the healthcheck eval: assert the agent fetches pricing.md and that
the cost comes from the fetched page, not "from the pricing reference".
* docs(auth0): defer to the pricing reference instead of restating its rules
Health-check side of the price-fetch change. Every remaining "from the pricing
reference" that referred to a figure now points at the fetched pricing page:
the self-service exact-cost recommendation, the A4AA 50% note, the feature
comparison preamble, the per-plan tables pointer, and the closing pitfall.
Feature availability, MAU limits, the feature->plan matrix, and plan/feature
naming still come from the co-loaded reference — those never moved.
Also drop the duplicated fetch/anti-memory wording from the source-of-truth
block and defer to the pricing reference's own quoting procedure and
fetch-failure rule. Restating a co-loaded reference's contract here is exactly
the drift the one-hop model avoids: one rule, one home.
* fix(auth0): restore three rules lost when folding the healthcheck references
Three narrow fixes from CodeRabbit's review of this PR. Each restores a
rule that #127 had, or tightens text this PR itself introduced -- none
change ported content.
MAU growth-rate unit. The formula reads `(1 + growth_rate)` while the
input spec says "15 means 15%/month". #127's mau-forecast-calculator.md
carried a `Where:` block defining growth_rate as a decimal (0.15 for
15%); collapsing ten files into one dropped it. An agent passing the
collected 15 straight into the formula forecasts 16x monthly growth
instead of 1.15x, which misreads the urgency band and can recommend an
upgrade the tenant does not need. Restored on the formula line.
No-scan hygiene path. The router's healthcheck block made the audit an
unconditional prerequisite, which reads as "stop if the scan cannot
run". Both the reference (feature-healthcheck.md) and #127 instead mark
hygiene "Not scored" and continue scoring capability fit. This router
line is new in this PR, not ported, so the fix tightens our own text.
pending_enterprise had no consumer. feature-healthcheck.md queues
plan-gated items as `pending_enterprise` when the recommendation is
"Enterprise -- contact sales", but the remediation gate only handled
`pending_upgrade` and `skipped` -- so it would ask whether the customer
had upgraded to a plan that has no self-service upgrade, and offer the
billing link for something sales has to quote. #127 had the same gap.
The gate now suppresses that question on the Enterprise path, defines
resume behavior, and states that a pending_enterprise item is never
presented as self-unlockable.
Five further issues CodeRabbit raised are real but inherited from #127
verbatim, and resolving them requires decisions #127 never wrote down
(e.g. ai_use_case is a boolean compared against "AI-Native", but #127
emits the combined string "AI-NATIVE OR AI-DIFFERENTIATED" and never
says how to choose). Those are left for the original authors rather than
re-authored here.
* style(auth0): satisfy markdownlint in the files this PR adds
feature-healthcheck.md and the healthcheck report template are new files,
so their markdownlint violations are new code rather than inherited
style. Add the blank lines MD022/MD031 want around headings and fences,
and a `text` language tag on the four bare fences MD040 flags -- the two
score formulas, the Talk-to-Sales template, and the report filename.
Whitespace and fence tags only: normalising `text` back to a bare fence
and dropping blank lines makes the file byte-identical to its previous
content, and the fence count is unchanged at 20.
SKILL.md is deliberately left alone. It has 45 violations of these rules
and 42 are already on main -- all 28 intent blocks use the same
unlanguaged-fence style, 27 of them pre-existing. Styling only the
healthcheck block would make it the odd one out, and the repo has no
markdownlint config or CI gate to align to yet.
* fix(auth0): separate growth-rate units and soften the audit prerequisite
Both of these are follow-ups on wording this PR introduced, flagged in a
second review pass.
The growth-rate note said to use the decimal "everywhere", which
overreaches: the Talk-to-Sales brief renders {{monthly_growth_rate}}%/mo
and four plan-matching branches threshold on `monthly_growth > 20%`, so
"everywhere" would print 15% as 0.15%/mo and stop those comparisons
matching. Name the conversion explicitly and keep the two units apart --
the decimal for the forecast arithmetic, the percentage for thresholds
and display.
The router's healthcheck line still opened with an unconditional "Run the
audit workflow first", which reads as a hard prerequisite even with the
no-scan clause appended. Make the condition the first thing stated, and
say plainly that capability fit, plan matching and the recommendation
still run when no scan is available.
* fix(auth0): make the health-check field names refer to fields that exist
Two field-name mismatches carried over from #127, both of which make a
condition read something nothing ever sets. Renames only -- no threshold,
formula or branch changes.
Plan matching gated on `readiness_score`, but the workflow produces
`fit_score`. These are the same metric: #127's use-case-detection-logic.md
pairs "readiness_score": 0.35 with "readiness_level": "Not Ready", and
"Not Ready" is the 0-39 band that scoring-model.md defines for fit_score.
So the mapping is grounded rather than guessed -- readiness_score was
fit_score on a 0-1 scale. Renamed to fit_score, with the thresholds moved
onto the 0-100 scale the bands already use (> 80% -> > 80), and the sample
output's paired key renamed to fit_level for consistency.
Four branches also read `monthly_growth` where the normalized fact set
defines `monthly_growth_rate`; both are the percentage, so this is the
name only.
The AI branches read `integrations.length` while the detection output
emits `ai_integrations` -- six sites, now all `ai_integrations`. Left
alone: the neighbouring `ai_use_case == "AI-Native"` comparison against a
boolean, which needs a discriminator #127 never defined.
* fix(auth0): stop routing a Custom Domain gap to a plan upgrade
Custom Domains is a Free-tier feature — the pricing page reads
`| Custom Domains* | 1 | Included | Included | Included |`, and the only
footnote is credit-card verification, not a plan gate. Neither #127 nor the
live pricing page mentions the separate "Multiple Custom Domains" concept, so
every reference here is to plain Custom Domains.
feature-audit.md already states this rule, and it is co-loaded with this file
on the healthcheck intent:
Common misconception to avoid: Custom Domains is NOT an upgrade feature —
the Free plan includes 1 custom domain (credit-card verification
required). Never place it under "After Upgrading."
The health-check logic contradicted it in four places:
- the CRITICAL-gap → minimum-unlocking-plan mapping sent Custom Domain to
"Essentials+", pushing a same-day fix into Loop B behind the upgrade gate
- both Free-plan branches listed Custom Domain as both an upgrade trigger and
an unlock, so a Free tenant was told to pay for what they already have
- the default branch's unlock list repeated it
- the feature_unlocks JSON example used it as the CRITICAL specimen
The unlock lists inherit from plan-matching-logic.md, whose flat prose lost the
`=` (already included) vs `✓` (newly unlocked) distinction that
feature-unlock-matrix.md uses to mark Custom Domain correctly.
CRITICAL severity for a missing custom domain is unchanged — scoring-model.md
is explicit that a missing required feature deducts "whether it's a free
toggle, a paid unlock, or Enterprise-only." Only the remediation route was
wrong.
* fix(auth0): pick the plan track from the business model, not the use case
The Free-plan AI and compliance branches hardcoded a B2B recommendation
regardless of the business model Phase 2 detected, so a B2C tenant with agent
integrations — or a B2C fintech — was routed onto the B2B track.
Nothing those branches offer requires B2B. The AI rows are byte-identical
across both tracks in the pricing reference:
CIBA | Not available | ADD-ON | ADD-ON | Included + ADD-ON
Token Vault | 2 | 3 + ADD-ON | 3 + ADD-ON | 4 + ADD-ON
M2M Auth | 1,000 | 1,000 | 5,000 | 5,000
as are Log Streaming and Pro MFA Factors. The B2B track is not equivalent,
though — at 500 MAU it costs $150/$800 against B2C's $35/$240 (3-4x), and its
published MAU ceiling is *lower* (B2B Professional stops at 10,000; B2C
Essentials is priced to 50,000). So the wrong track over-quotes the customer
for capability it already had and shrinks its growth headroom, eventually
manufacturing an Enterprise conversation the self-service path exists to avoid.
Changes:
- introduce `<track>` (B2B when business_model == "B2B", else B2C) and use it
in the three Free-plan branches and the shared A4AA detection logic, with the
reasoning stated so it isn't re-hardcoded later
- gate M2M Access for Organizations on the B2B track — it is the one genuine
B2B-only feature the autonomous-actions branch listed
- add the missing A4AA branches to B2C Essentials and B2C Professional. #127
had AI branches only under the B2B blocks, so a B2C tenant with agent
integrations was never offered A4AA at all
- note that Breached Password Detection is Professional+ on *both* tracks, so
the compliance branch's Essentials recommendation cannot deliver the feature
its own rationale cites
Whether a regulated vertical genuinely requires BPD (recommend Professional) or
not (drop it from the rationale) is left to the authors; the text now states the
constraint either way instead of implying Essentials covers it.
* fix(auth0): trim SKILL.md under the skillsaw context-budget limit
* fix(auth0): resolve six health-check scoring/plan-matching logic issues
Addresses CodeRabbit findings on #142 (originating in #127), all in the
consolidated feature-healthcheck reference:
1. A4AA fit bonuses were dead code (boolean compared to strings). Thread
ai_use_case as an enum end-to-end; gate on {AI-Native,AI-Differentiated}
with a flat +0.30, and stop AI-Enhanced tenants tripping the CRITICAL
Token Vault/CIBA branch.
2. B2C Essentials MAU branch no longer routes to B2C Professional (a lower
MAU ceiling); stays on Essentials + SOFT Enterprise path.
3. Regulated-vertical branch stops citing BPD (Professional-only) as a reason
for the Essentials recommendation.
4. Missing current_plan/use_case now defaults (not halts), consistent with the
confidence-scoring + graceful-degradation design.
5. MIXED is auto-reachable (both-segments check before B2B) and gets its own
B2B Essentials plan branch; final ELSE relabeled UNKNOWN.
6. Scan report normalized to the canonical flat finding array with the real
5-value severity scale; drop the stale ~50-check figure; remove the wrong
Enterprise-Connection-count tier gate.
---------
Co-authored-by: Sanchit Mehta <sanchit.mehta@okta.com>
|
||
|
Frederik Prijck
|
f3a001e3f0 |
feat: add author-auth0-skill contributor skill (#140)
* feat: add author-auth0-skill contributor skill Consolidates the design spec, implementation plan, and review-fix iterations into a single skill: a router SKILL.md that guides contributors through authoring or editing an Auth0 skill (frontmatter, directory structure, naming, and validation). * fix(author-auth0-skill): update contributor skill for uniform-folder model Rebased contributor-skill onto main to pick up #163's migration to directories-with-index.md (+ optional leaf groups) and rewrote the authoring paths, splitting guidance, and validation gate to match. * fix(author-auth0-skill): sharpen leaf-group split guidance Cap is 1000 lines, not "split once it grows past ~1000" — consider splitting starting at ~500, and only when content actually separates into distinct sections rather than being long but cohesive. |
||
|
Frederik Prijck
|
b4c7bc08d3 | refactor(auth0): migrate to uniform-folder model (#163) | ||
|
Frederik Prijck
|
cfd0bce605 | feat(auth0): add tenant security audit with gated remediation (#141) | ||
|
sanchitmehtagit
|
e6ffc31f1a |
fix(swift): remove programmatic-init example with hardcoded credentials (#155)
The "Programmatic Initialization" section taught the explicit-credentials factory form (`webAuth(clientId:domain:)`, `authentication(clientId:domain:)`) with inline `"YOUR_CLIENT_ID"` / `"YOUR_DOMAIN"` placeholders. Lower-capability models copy this form verbatim and hardcode credentials into source, tripping the security graders and diverging from the recommended `Auth0.plist` path. Remove the section so the skill teaches a single, secure configuration path (Auth0.plist). The migration/detection references to `webAuth(domain:clientId:)` elsewhere are unaffected — they identify existing call sites to upgrade, not patterns to author. |
||
|
sanchitmehtagit
|
e295fd6459 |
fix(auth0): remove stray paren in ionic-vue logout snippet (#159)
The Ionic Vue logout snippet had a stray ) after the packageId assignment (const packageId = "YOUR_PACKAGE_ID";)), producing invalid JavaScript. This fix was originally made in #120 but was lost in the v2.0 re-architecture (#137) when the per-skill files were consolidated into the flat reference pool. |
||
|
sanchitmehtagit
|
a3e0db8ecb |
fix(auth0): remove hardcoded Auth0.getInstance init from Android reference (#157)
* fix(auth0): remove hardcoded Auth0.getInstance init from Android reference
The API Reference showed `Auth0.getInstance("CLIENT_ID", "DOMAIN")` as an
equal alternative to `Auth0.getInstance(context)`. Lower-capability models
tend to copy this literal-credential variant, hardcoding client ID and domain
in .kt source instead of using strings.xml. Remove the direct variant and add
an explicit note to always initialize from strings.xml.
* fix(auth0): warn against Auth0.getInstance(clientId, domain) hardcoding
Add the explicit warning at the Quick Start initialize step and a Common
Mistakes row against passing clientId/domain to Auth0.getInstance(). Restores
guidance from #117 that was lost in the v2.0 re-architecture (#137).
|
||
|
sanchitmehtagit
|
b4729046c7 |
fix(auth0): restore Nuxt runtimeConfig auto-population guidance (#160)
Restore the guidance that runtimeConfig values should be left as empty strings so Nuxt auto-fills them from NUXT_AUTH0_* env vars at runtime, plus a Common Mistakes row against hardcoding credentials in nuxt.config.ts. Originally added in #114, lost in the v2.0 re-architecture (#137) when per-skill files were consolidated into the flat reference pool. |
||
|
sanchitmehtagit
|
3002420221 |
fix(auth0): use SDK-native ISSUER_BASE_URL/AUDIENCE env vars in Express JWT reference (#158)
* fix(auth0): use SDK-native ISSUER_BASE_URL/AUDIENCE env vars in Express JWT reference The express-oauth2-jwt-bearer reference taught AUTH0_DOMAIN/AUTH0_AUDIENCE and constructed issuerBaseURL from a domain. Switch to the SDK's native ISSUER_BASE_URL/AUDIENCE keys, read directly, so generated code matches the package's documented configuration. Update all code snippets, .env blocks, config/env tables, setup-guide wording, and the Common Issues/Common Mistakes rows for consistency. Note that ISSUER_BASE_URL is a full URL including https:// (unlike the bare-hostname AUTH0_DOMAIN), and flip the "domain includes https://" mistake row accordingly. * fix(auth0): correct ISSUER_BASE_URL format note in Express JWT reference Verified against the express-oauth2-jwt-bearer source: the SDK's normalizeIssuerUrl auto-prepends https:// to a bare hostname, so a missing scheme does not error at startup (only HTTP is rejected under NODE_ENV=production). Reword the Common Mistakes row accordingly instead of claiming an "Invalid URL" startup error. * refactor(auth0): call auth() with no args in Express JWT reference Mirror the approach from #126: instead of passing issuerBaseURL/audience explicitly, let express-oauth2-jwt-bearer read ISSUER_BASE_URL / AUDIENCE from the environment via a zero-argument auth() call. Add .env-first guidance to the Quick Start, an anti-hardcoding Common Mistakes row, and align the config/env tables to "optional — defaults to env var". |
||
|
sanchitmehtagit
|
97b9d9a5ce |
fix(auth0): warn against passing credentials in code for Swift (#161)
* fix(auth0): warn against passing credentials in code for Swift Restore the explicit prohibition against hardcoding clientId/domain in Swift source or passing them as arguments to Auth0.webAuth() / Auth0.authentication() when Auth0.plist is present, with correct/incorrect examples and a Common Mistakes row. Originally added in #101, lost in the v2.0 re-architecture (#137) when per-skill files were consolidated into the flat reference pool. * fix(auth0): reword swift escape-hatch note to pair with positive guidance |
||
|
sanchitmehtagit
|
7e9ce86982 |
fix(android): correct logout callback onSuccess signature to Void? (#154)
The Web Auth logout examples declared `override fun onSuccess(result: Void)` under a `Callback<Void?, AuthenticationException>` type parameter. The nullability mismatch (Void vs Void?) fails Kotlin compilation. Align both logout samples with the type parameter and the other correct callback examples in the same file. |