Epic: v1.0 stable platform

Abierto
  • ¿Algo no está bien?
#66 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
15/100
Tipo de issue
Nueva funcionalidad
Claridad
Necesita aclaración
Estado de actividad
Tranquilo
Stack tecnológico
typescript
Área
authentication

Línea de trabajo

This is a tracking issue rather than a scoped code change; no files or tests are named. Start by reviewing the linked contract, error-shape, and per-flow issues, then clarify with maintainers which open milestone is actionable. Done would require completing an agreed milestone; the licensing item is already resolved by #335.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement epic help wanted P4 safe v1.0

v1.0 release epic

This issue is the epic for the v1.0 milestone: a stable platform people can bet on. Besides the items below it covers an upgrade and version-skew policy, config as code, full export, an independent security review, a reference deployment, and the run-anywhere items (#374 to #377). All are linked as sub-issues.

Context

From a project-quality review. The engineering fundamentals are strong (correct token rotation + reuse detection, constant-time comparisons, RS256 pinned, fail-closed secrets, broad test coverage). The gaps to a broad "yes, use this in production" recommendation are about project maturity, not code quality. This is a tracking issue for those.

Milestones

  • Stable, documented contract + 1.0. Freeze route/schema/token/status-code contract; finish in-flight deprecations (e.g. GET /logout). Ties into the error-shape and per-flow contract issues.
  • Independent security audit / pentest you can cite, focused on the auth, token, OTP, session, and crypto paths.
  • Reduce bus factor — a second maintainer or an org/sponsor backing, so CVE response does not depend on one person.
  • Licensing path for AGPL-averse adopters — evaluate a dual-license / commercial option so the AGPL-3.0 terms are not a hard blocker for companies. Decided 2026-10-05: relicense the whole ecosystem to Apache-2.0 instead of a dual license (#335). Done: everything is Apache-2.0 as of #335.
  • Reference production deployment(s) / case study to demonstrate real-world operation.

Why it matters

For an auth server, longevity, audit attestation, and maintainer responsiveness weigh as heavily as code quality for adopters in regulated or high-stakes contexts.

Lenguaje dominante
TypeScript
Estrellas
2
Forks
2
Merge medio
11 h 40 min
PR fusionados (30 d)
104

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de fells-code/seamless-auth-api

Todos los issues de fells-code/seamless-auth-api

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.