docs(enterprise): cover 2.4.0 SSO/SCIM/MFA/M2M gaps, fix drift#76
Open
lakhansamani wants to merge 4 commits into
Open
docs(enterprise): cover 2.4.0 SSO/SCIM/MFA/M2M gaps, fix drift#76lakhansamani wants to merge 4 commits into
lakhansamani wants to merge 4 commits into
Conversation
Server shipped a batch of enterprise features after 2.3.0 with no docs, and a few existing pages had drifted from the current code: - add SAML 2.0 Identity Provider role (enterprise/saml-idp.md) - add verified domains + home realm discovery (enterprise/org-domains.md) - scim.md: groups (was documented as unimplemented), filter operators, full user PATCH, provisioning webhooks - security.md/server-config.md: WebAuthn/passkey ceremonies, MFA default-on + --disable-mfa, withheld-token setup, lockout + admin recovery - client-registry.md: service accounts as FGA subjects, public client_id, 503 on transient lookup failure - workload-identity.md: TokenReview config now admin-settable - oauth2-oidc.md/grpc.md/rest-api.md: RFC 8414 alias, RFC 8707 resource binding on auth-code flow, refresh-reuse grace window, 21 missing admin RPCs - graphql-api.md: skip_mfa_setup/lock_mfa/email_otp_mfa_setup/ sms_otp_mfa_setup were undocumented on every surface (GraphQL/gRPC/ REST) - organizations.md/org-saml.md: cross-link the two new pages - sidebars.ts: wire in new pages, renumber sidebar_position Every claim verified against authorizer @ e26a1253 (2.4.0-rc.8), not just commit messages or the pre-implementation design specs.
✅ Deploy Preview for authorizerdev-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
…ation - organizations.md/org-saml.md/org-sso-oidc.md/scim.md: fix false "super-admin only" claim; document authorizer:org_admin role - server-config.md/security.md: document --url trusted-base-url flag (closes CWE-640 host-header-injection) - security.md/graphql-api.md: document synchronous session revocation on self-service password reset
- enable @docusaurus/theme-mermaid (markdown.mermaid + themes config) - convert ascii/box-drawing diagrams to mermaid flowchart/sequenceDiagram in authorization.md, sso-guide.md, org-sso-oidc.md, saml-idp.md, workload-identity.md - authorization.md: turn the tuple-listing block into a real table instead of ascii-art comments - verified rendering in a local build (light + dark mode, flowchart + sequenceDiagram) via docusaurus serve
Server main moved 10 commits past the last-verified HEAD, including a breaking GraphQL change; SDK docs had drifted independently. Verified every fix below against real source (not commit messages), and against the authorizerdev/examples repo where a matching example exists. Server-side (breaking change + new field): - fix(graphql)! pagination standardized to single-level shape across _verification_requests, _webhooks, _email_templates, _audit_logs - add is_discord_login_enabled to the meta query - add the 7 SCIM/group webhook event names to _add_webhook's allow-list Pre-existing bugs found and fixed (unrelated to any recent server change): - _audit_logs: wrong response field name (entries -> audit_logs), 3 missing request params - _add_email_template: missing required `subject` field - invalid GraphQL syntax in the _users sample - a duplicated heading that corrupted the _update_user anchor - fga-guide.md's runnable curl example 403s without an Origin header (CSRF enforcement) - added it - mcp.md's runnable examples passed --fga-store a URI (wrong flag; that's --fga-store-url) - react-native.md documented a deprecated implicit-flow/expo-cli pattern; the real example uses PKCE + expo-secure-store - rewritten - authorizer-go docs had a string literal assigned to a *string field (won't compile) and an admin doc's example used the wrong constructor - authorizer-react docs described a config key (extraHeaders) that does not exist anywhere in source; removed New recipes/sections added from examples not yet covered: - authorization.md: service_account FGA subjects, permission-aware RAG/AI-agent retrieval recipe - mcp.md: Authorizer as OAuth 2.1 AS for a separate MCP resource server - token-exchange.md: link to the multi-hop delegation example SDK docs (js/go/python/react/svelte/vue) brought up to date against each SDK's actual latest source: - authorizer-js: 6 wrong examples/field names fixed (incl. two that would silently no-op), ~20 missing functions added (MFA, WebAuthn, M2M/token-exchange grants), full admin surface added (46 methods) - authorizer-go: compile-error example fixed, 18 missing client methods + ~50 missing admin methods added, Go internal-package import constraint documented - authorizer-python: SignUpRequest field removed to match a breaking SDK change, GetTokenRequest/Response under-documented (4/13 fields), 11 missing MFA/WebAuthn methods added, 46 of 81 admin methods added - authorizer-react: fabricated extraHeaders prop removed, 4 new components added (passkey login/register, MFA setup, TOTP scanner) with verified props, several existing components had wrong/missing props fixed - authorizer-svelte: a wrong prop on AuthorizerSocialLogin fixed (copy-paste from another component), several missing props added - authorizer-vue: rewritten from a two-line stub into a full getting-started + component reference sso-guide.md: added cross-links to the two new enterprise pages (saml-idp, org-domains); gatsbyjs.md: fixed a missing required stylesheet import step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Server shipped a batch of enterprise features after 2.3.0 with zero docs, plus existing pages had drifted from current code — and a full accuracy audit against
authorizermain, theauthorizerdev/examplesrepo, and all 7 SDK repos surfaced real, independent bugs. 4 commits, each independently buildable.Commit 1 — new pages + gap-filling:
enterprise/saml-idp.md(SAML IdP role),enterprise/org-domains.md(verified domains + HRD), SCIM groups/webhooks/PATCH, WebAuthn/MFA redesign, RFC 8414/8707 additions, 21 missing admin RPCs in grpc.md/rest-api.md, 4 undocumented GraphQL mutations.Commit 2 — org-scoped admin + 2 more gaps: fixed a false "super-admin only" claim (org-admin can now self-manage SSO/SCIM/domains), documented the
--urltrusted-base-url flag (closes a CWE-640 host-header-injection path), documented synchronous session revocation on password reset.Commit 3 — Mermaid diagrams: enabled
@docusaurus/theme-mermaid, converted every ASCII/box-drawing diagram (5 files) toflowchart/sequenceDiagram. Verified rendering visually in a local build, light + dark mode.Commit 4 — full accuracy audit: server
mainmoved 10 commits past what was last verified, including a breaking GraphQL change (pagination shape). Fixed that across every affected doc, plus found and fixed several pre-existing, unrelated bugs:_audit_logsdocs had the wrong response field name and were missing 3 request params_add_email_templatewas missing a required field_update_useranchorfga-guide.md's runnable curl example would 403 (missing requiredOriginheader)mcp.md's runnable examples used the wrong CLI flagreact-native.mddocumented a deprecated implicit-flow/Expo-CLI pattern; rewritten to match the real PKCE-based exampleauthorizer-godocs had a string literal in a*stringfield (won't compile)authorizer-reactdocs described a config prop (extraHeaders) that doesn't exist anywhere in source — removedEvery SDK doc set (JS, Go, Python, React, Svelte, Vue) was diffed against its actual current exported API. Two admin surfaces were dramatically under-documented — 46 of 81 methods missing in Python, a similar gap in Go.
authorizer-reactgot 4 new components (passkey login/register, MFA setup, TOTP scanner) with props verified against source.authorizer-vue's doc was rewritten from a two-line stub into a full reference. New recipes added from examples not previously covered:service_accountFGA subjects, permission-aware RAG/AI-agent retrieval, Authorizer as an OAuth 2.1 AS for external MCP resource servers.Test plan
npm run build— clean, no broken-link warnings, after every commitnpm run typecheck— clean