AUTH-SUPERTOKENS-PARITY-MATRIX.md 3.1 KB
SuperTokens ↔ Briven Auth parity matrix (living tracker)
Sprint: AUTH-ST-GAPS-1 + close-last-15% + AUTH-HARDEN-90
Updated: 2026-07-29 (harden test evidence — see AUTH-HARDEN-TEST-EVIDENCE-2026-07-29.md)
Rule: Claim “100% SuperTokens” only when every row is Y or N/A (approved).
Gold path: AUTH-GOLD-PATH.md
Legend: Y done · P partial · N not done · N/A won’t do
| Area | SuperTokens surface | Briven Auth | Status |
|---|---|---|---|
| Engine | Core + recipes | briven-engine / Doltgres | Y |
| Email password | Recipe | emailpassword (+ foreign hash upgrade) | Y |
| Magic link | Recipe | passwordless magic | Y |
| Email OTP | Recipe | passwordless email | Y |
| SMS OTP | Recipe | passwordless SMS + honesty UI | P (ops: Twilio From) |
| Social | thirdparty | thirdparty catalog | Y |
| Passkeys | webauthn | webauthn FDI + hosted FDI + engine helpers | Y (live retest after deploy) |
| TOTP MFA | multifactorauth | mfa + challenge ticket | Y |
| Sessions | session recipe | native sessions | Y |
| Roles | userroles | be_roles | Y |
| M2M | oauth2 client_credentials | m2m | Y |
| SAML SP | sso | sso saml | Y |
| OIDC SP | sso | sso oidc | Y |
| OIDC IdP | oauth2provider | oidc IdP + hosted login FDI + consent | P → Y for code path 2026-07-29; human app still optional |
| User migration | bulk import | migration API + bcrypt/argon2 verify | Y |
| Framework SDKs | many | Next gold + Express/Hono/vanilla + passkey scaffold | Y (breadth N/A pending) |
| Custom JWT claims | claims | project jwtClaims | Y |
| GDPR export | data export | users/:id/export | Y |
| Username login | username | metadata + flag | Y |
| Captcha | plugin | Turnstile when secret set (EP + passwordless) | Y when keys set; off when not |
| First-party proxy | app domain sessions | /api/auth FDI | Y |
| SuperTokens Core Docker | Core | N/A (Doltgres) | N/A |
| Security FDI lock | app key | pk_brivenauth + project required | Y (live re-proved 2026-07-29) |
| Session refresh contract | session recipe | FDI /session/refresh |
Y (live fail-closed; rotate needs cookie) |
| OIDC IdP discovery | oauth2provider | …/oidc/.well-known/openid-configuration |
Y (live 200) |
| M2M token fail path | client_credentials | /v1/auth-core/oauth/token |
Y (live invalid_client) |
| Captcha | plugin | Turnstile when secret set | Y unit; off on France (no secret) |
Claim status
Cannot claim 100% yet until:
Batch A security is liveDone (re-proved 2026-07-29).- SMS is either live-proved or N/A approved.
- Optional: IdP human browser once; framework breadth N/A approved.
- Apps on gold path only (Mavi/Krypco/Konnos fixes 2026-07-29 — ship Mavi).
Closest path to claim: SMS N/A or prove + approve framework N/A + ship app remaps.
~% snapshot (2026-07-29)
| Band | ~% |
|---|---|
| Day-to-day SaaS login | ~90–95% |
| Full ST-style surface (after harden test) | ~90–93% |
| Official 100% claim | Not claimed |
Test evidence: AUTH-HARDEN-TEST-EVIDENCE-2026-07-29.md