konnosDashboard
AUTH-SUPERTOKENS-PARITY-MATRIX.md59 lines · main
1# SuperTokens ↔ Briven Auth parity matrix (living tracker)
2
3**Sprint:** AUTH-ST-GAPS-1 + close-last-15% + **AUTH-HARDEN-90**
4**Updated:** 2026-07-29 (harden **test** evidence — see `AUTH-HARDEN-TEST-EVIDENCE-2026-07-29.md`)
5**Rule:** Claim “100% SuperTokens” only when every row is **Y** or **N/A (approved)**.
6**Gold path:** [`AUTH-GOLD-PATH.md`](./AUTH-GOLD-PATH.md)
7
8Legend: **Y** done · **P** partial · **N** not done · **N/A** won’t do
9
10| Area | SuperTokens surface | Briven Auth | Status |
11|------|---------------------|-------------|--------|
12| Engine | Core + recipes | briven-engine / Doltgres | Y |
13| Email password | Recipe | emailpassword (+ foreign hash upgrade) | Y |
14| Magic link | Recipe | passwordless magic | Y |
15| Email OTP | Recipe | passwordless email | Y |
16| SMS OTP | Recipe | passwordless SMS + honesty UI | P (ops: Twilio From) |
17| Social | thirdparty | thirdparty catalog | Y |
18| Passkeys | webauthn | webauthn FDI + hosted FDI + engine helpers | Y (live retest after deploy) |
19| TOTP MFA | multifactorauth | mfa + challenge ticket | Y |
20| Sessions | session recipe | native sessions | Y |
21| Roles | userroles | be_roles | Y |
22| M2M | oauth2 client_credentials | m2m | Y |
23| SAML SP | sso | sso saml | Y |
24| OIDC SP | sso | sso oidc | Y |
25| OIDC IdP | oauth2provider | oidc IdP + hosted login FDI + consent | P → Y for code path 2026-07-29; human app still optional |
26| User migration | bulk import | migration API + bcrypt/argon2 verify | Y |
27| Framework SDKs | many | Next gold + Express/Hono/vanilla + passkey scaffold | Y (breadth N/A pending) |
28| Custom JWT claims | claims | project jwtClaims | Y |
29| GDPR export | data export | users/:id/export | Y |
30| Username login | username | metadata + flag | Y |
31| Captcha | plugin | Turnstile when secret set (EP + passwordless) | Y when keys set; off when not |
32| First-party proxy | app domain sessions | /api/auth FDI | Y |
33| SuperTokens Core Docker | Core | N/A (Doltgres) | N/A |
34| Security FDI lock | app key | pk_briven_auth_ + project required | Y (live re-proved 2026-07-29) |
35| Session refresh contract | session recipe | FDI `/session/refresh` | Y (live fail-closed; rotate needs cookie) |
36| OIDC IdP discovery | oauth2provider | `…/oidc/.well-known/openid-configuration` | Y (live 200) |
37| M2M token fail path | client_credentials | `/v1/auth-core/oauth/token` | Y (live invalid_client) |
38| Captcha | plugin | Turnstile when secret set | Y unit; **off** on France (no secret) |
39
40## Claim status
41
42**Cannot claim 100% yet** until:
43
441. ~~Batch A security is live~~ **Done** (re-proved 2026-07-29).
452. SMS is either **live-proved** or **N/A approved**.
463. Optional: IdP human browser once; framework breadth N/A approved.
474. Apps on gold path only (Mavi/Krypco/Konnos fixes 2026-07-29 — ship Mavi).
48
49Closest path to claim: SMS N/A or prove + approve framework N/A + ship app remaps.
50
51## ~% snapshot (2026-07-29)
52
53| Band | ~% |
54|------|-----|
55| Day-to-day SaaS login | ~90–95% |
56| Full ST-style surface (after harden test) | ~90–93% |
57| Official 100% claim | Not claimed |
58
59**Test evidence:** [`AUTH-HARDEN-TEST-EVIDENCE-2026-07-29.md`](./AUTH-HARDEN-TEST-EVIDENCE-2026-07-29.md)
Preview

SuperTokens ↔ Briven Auth parity matrix (living tracker)

Sprint: AUTH-ST-GAPS-1 + close-last-15% + AUTH-HARDEN-90
Updated: 2026-07-29 (harden test evidence — see AUTH-HARDEN-TEST-EVIDENCE-2026-07-29.md)
Rule: Claim “100% SuperTokens” only when every row is Y or N/A (approved).
Gold path: AUTH-GOLD-PATH.md

Legend: Y done · P partial · N not done · N/A won’t do

AreaSuperTokens surfaceBriven AuthStatus
EngineCore + recipesbriven-engine / DoltgresY
Email passwordRecipeemailpassword (+ foreign hash upgrade)Y
Magic linkRecipepasswordless magicY
Email OTPRecipepasswordless emailY
SMS OTPRecipepasswordless SMS + honesty UIP (ops: Twilio From)
Socialthirdpartythirdparty catalogY
Passkeyswebauthnwebauthn FDI + hosted FDI + engine helpersY (live retest after deploy)
TOTP MFAmultifactorauthmfa + challenge ticketY
Sessionssession recipenative sessionsY
Rolesuserrolesbe_rolesY
M2Moauth2 client_credentialsm2mY
SAML SPssosso samlY
OIDC SPssosso oidcY
OIDC IdPoauth2provideroidc IdP + hosted login FDI + consentP → Y for code path 2026-07-29; human app still optional
User migrationbulk importmigration API + bcrypt/argon2 verifyY
Framework SDKsmanyNext gold + Express/Hono/vanilla + passkey scaffoldY (breadth N/A pending)
Custom JWT claimsclaimsproject jwtClaimsY
GDPR exportdata exportusers/:id/exportY
Username loginusernamemetadata + flagY
CaptchapluginTurnstile when secret set (EP + passwordless)Y when keys set; off when not
First-party proxyapp domain sessions/api/auth FDIY
SuperTokens Core DockerCoreN/A (Doltgres)N/A
Security FDI lockapp keypk_briven_auth_ + project requiredY (live re-proved 2026-07-29)
Session refresh contractsession recipeFDI /session/refreshY (live fail-closed; rotate needs cookie)
OIDC IdP discoveryoauth2provider…/oidc/.well-known/openid-configurationY (live 200)
M2M token fail pathclient_credentials/v1/auth-core/oauth/tokenY (live invalid_client)
CaptchapluginTurnstile when secret setY unit; off on France (no secret)

Claim status

Cannot claim 100% yet until:

  1. Batch A security is live Done (re-proved 2026-07-29).
  2. SMS is either live-proved or N/A approved.
  3. Optional: IdP human browser once; framework breadth N/A approved.
  4. Apps on gold path only (Mavi/Krypco/Konnos fixes 2026-07-29 — ship Mavi).

Closest path to claim: SMS N/A or prove + approve framework N/A + ship app remaps.

~% snapshot (2026-07-29)

Band~%
Day-to-day SaaS login~90–95%
Full ST-style surface (after harden test)~90–93%
Official 100% claimNot claimed

Test evidence: AUTH-HARDEN-TEST-EVIDENCE-2026-07-29.md