Epic: v1.0 stable platform

Open
  • Is something wrong?
#66 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
15/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Quiet
Tech stack
typescript
Domain
authentication

Research direction

This is a tracking issue rather than a scoped code change; no files or tests are named. Start by reviewing the linked contract, error-shape, and per-flow issues, then clarify with maintainers which open milestone is actionable. Done would require completing an agreed milestone; the licensing item is already resolved by #335.

Written by the indexing model from the issue text.

Description

enhancement epic help wanted P4 safe v1.0

v1.0 release epic

This issue is the epic for the v1.0 milestone: a stable platform people can bet on. Besides the items below it covers an upgrade and version-skew policy, config as code, full export, an independent security review, a reference deployment, and the run-anywhere items (#374 to #377). All are linked as sub-issues.

Context

From a project-quality review. The engineering fundamentals are strong (correct token rotation + reuse detection, constant-time comparisons, RS256 pinned, fail-closed secrets, broad test coverage). The gaps to a broad "yes, use this in production" recommendation are about project maturity, not code quality. This is a tracking issue for those.

Milestones

  • Stable, documented contract + 1.0. Freeze route/schema/token/status-code contract; finish in-flight deprecations (e.g. GET /logout). Ties into the error-shape and per-flow contract issues.
  • Independent security audit / pentest you can cite, focused on the auth, token, OTP, session, and crypto paths.
  • Reduce bus factor — a second maintainer or an org/sponsor backing, so CVE response does not depend on one person.
  • Licensing path for AGPL-averse adopters — evaluate a dual-license / commercial option so the AGPL-3.0 terms are not a hard blocker for companies. Decided 2026-10-05: relicense the whole ecosystem to Apache-2.0 instead of a dual license (#335). Done: everything is Apache-2.0 as of #335.
  • Reference production deployment(s) / case study to demonstrate real-world operation.

Why it matters

For an auth server, longevity, audit attestation, and maintainer responsiveness weigh as heavily as code quality for adopters in regulated or high-stakes contexts.

Dominant language
TypeScript
Stars
2
Forks
2
Avg merge
11h 40m
Merged PRs (30d)
104

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from fells-code/seamless-auth-api

All issues in fells-code/seamless-auth-api

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.