Skip to main content

Security Architecture

Authentication Architecture​

OAuth2 Login​

  • Based on Spring Security OAuth2 Client
  • Phase 1 supports GitHub
  • Architecture supports extending multiple providers

CLI Authentication​

  • OAuth Device Flow
  • Web authorization issues CLI credentials
  • Supports API Token

Session Management​

  • Spring Session + Redis
  • Distributed session sharing
  • Supports multi-pod deployment

Authorization Architecture​

Platform Roles​

RolePermissions
SUPER_ADMINAll permissions
SKILL_ADMINSkill governance
USER_ADMINUser governance
AUDITORAudit read-only

Namespace Roles​

RolePermissions
OWNERNamespace owner
ADMINReview, member management
MEMBERPublish skills

Visibility Rules​

VisibilityWho can access
PUBLICAnyone (anonymous)
NAMESPACE_ONLYNamespace members
PRIVATEowner + namespace ADMIN

Auditing​

All critical operations synchronously write to audit logs:

  • Publish, download, delete
  • Review approval, rejection
  • Permission changes
  • Configuration changes

Rate Limiting​

  • Ingress layer basic rate limiting (Nginx)
  • Application layer fine-grained rate limiting (Redis sliding window)

Next Steps​