newheap-authentication

Files (8)

• SKILL.md
• openai.yaml · agents/
• ai-aspnet-context.md · references/
• authentication-overrides.md · references/
• authentication-passkeys.md · references/
• authentication-session-lifecycle.md · references/
• authentication-two-factor.md · references/
• authorization-permissions.md · references/

SKILL.md (first lines)

# NewHeap authentication

Keep consumer-specific identity and resource rules in the consuming application while preserving NewHeap's standard endpoints, cookies and refresh-token behavior unless the requested protocol explicitly changes them.

Read [authentication session lifecycle](references/authentication-session-lifecycle.md) for refresh rotation, logout revocation, password-driven session invalidation, compatible rollout or Microsoft OAuth sign-in. Read [authentication overrides](references/authentication-overrides.md) for token customization, claim hydration or removed-user behavior. Read [authorization permissions](references/authorization-permissions.md) for application, division or resource scopes. Read [two-factor authentication](references/authentication-two-factor.md) for authenticator apps, recovery codes, e-mail codes, second-factor challenges, required enrollment, remembered devices, two-factor administration or the two-factor components. Read [passkeys](references/authentication-passkeys.md) for passwordless sign-in or passkeys as a second factor. Read only the references whose boundaries the task crosses.

Preserve the complete authorization chain: seeded role or claim, token or claim hydration, backend policy enforcement and frontend visibility. Application, division and resource permissions are separate scopes. Resource claims encode the resource identity and validate that it belongs to the active division.

For large or volatile claims, keep stable application claims in the token and restore current claims through `IClaimsTransformation`. Cache per request, deduplicate claims and make a valid token for a removed user produce `401`.

Verify backend enforcement independently from frontend visibility and report the claim scopes and denial paths exercised.

## AI invocation context

Read [ASP.NET AI context](references/ai-aspnet-context.md) when an AI feature needs the authenticated actor, tenant, active-division scope and capability grants of a request, including OIDC issuers with unmapped claims and single-tenant or tenantless hosts. The AI features that use this context belong to the backend module.

From NewHeap/NewHeap-Platform, Apache-2.0.

More from NewHeap/NewHeap-Platform