Skip to content

Commit ba6ea1a

Browse files
feat(auth0): fold tenant audit (CheckMate) into the unified skill
Add an 'audit' intent to the unified auth0 router that runs an Auth0 CheckMate tenant configuration/security audit, produces a markdown + PDF report, and applies approved fixes via the Auth0 CLI with per-command confirmation. - SKILL.md: Step 1 intent row + Step 4 load block; extend the description. - references/feature-audit.md: full workflow (CLI bootstrap, M2M app, company context, CheckMate run, report fusion, gated apply loops). - references/feature-audit-pricing.md: feature to plan matrix (shared). - references/feature-audit-remediation.md: command-shape map + safety rules. - scripts/render_pdf.sh + assets/audit/report-template.{md,html}. - Routing eval (audit-tenant) + README coverage.
1 parent ec605c3 commit ba6ea1a

9 files changed

Lines changed: 1802 additions & 2 deletions

File tree

plugins/auth0/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ npx skills add auth0/agent-skills/plugins/auth0
2828

2929
| Skill | Description | Documentation |
3030
|-------|-------------|---------------|
31-
| [auth0](skills/auth0) | Adds Auth0 authentication to any app. Covers 35+ frameworks (React, Next.js, Vue, Angular, Express, Flask, FastAPI, Spring Boot, Swift, Android, Flutter, Laravel, Go, PHP, .NET MAUI, ASP.NET Core, React Native, Expo, Ionic, and more), MFA, Organizations, custom domains, ACUL screen generation, branding, debugging auth errors, security best practices, and migration from other providers. | [SKILL.md](skills/auth0/SKILL.md) |
31+
| [auth0](skills/auth0) | Adds Auth0 authentication to any app. Covers 35+ frameworks (React, Next.js, Vue, Angular, Express, Flask, FastAPI, Spring Boot, Swift, Android, Flutter, Laravel, Go, PHP, .NET MAUI, ASP.NET Core, React Native, Expo, Ionic, and more), MFA, Organizations, custom domains, ACUL screen generation, branding, debugging auth errors, security best practices, running a tenant security & configuration audit (CheckMate), and migration from other providers. | [SKILL.md](skills/auth0/SKILL.md) |
3232

3333
## Forcing the skill with `/auth0`
3434

plugins/auth0/skills/auth0/SKILL.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: auth0
3-
description: Use when adding, fixing, or improving authentication in any app — login, logout, signup, route protection, JWT/access token validation, refresh token rotation, MFA, passkeys, step-up auth, SSO, RBAC, Organizations for B2B multi-tenant SaaS, custom login domains, ACUL, or Universal Login branding. Use even if Auth0 isn't mentioned — any time a developer asks how to authenticate users, secure an API, debug a 401, CORS error, callback URL mismatch, redirect loop, or 429 rate limit, or migrate from Clerk, NextAuth.js, Firebase Auth, Supabase, Cognito, or Passport.js. Covers React, Next.js, Vue, Nuxt, Angular, Express, Flask, FastAPI, Spring Boot, Go, Swift, Android, Flutter, PHP, Laravel, ASP.NET Core, React Native, Expo, Ionic, and all Auth0 SDKs.
3+
description: Use when adding, fixing, or improving authentication in any app — login, logout, signup, route protection, JWT/access token validation, refresh token rotation, MFA, passkeys, step-up auth, SSO, RBAC, Organizations for B2B multi-tenant SaaS, custom login domains, ACUL, or Universal Login branding. Use to audit a tenant (CheckMate) or fix findings. Use even if Auth0 isn't mentioned — any time a developer asks how to authenticate users, secure an API, debug a 401, CORS error, callback URL mismatch, redirect loop, or 429 rate limit, or migrate from Clerk, NextAuth.js, Firebase, Supabase, Cognito, or Passport.js. Covers React, Next.js, Vue, Nuxt, Angular, Express, Flask, FastAPI, Spring Boot, Go, Swift, Android, Flutter, PHP, Laravel, ASP.NET Core, React Native, Expo, Ionic, and all Auth0 SDKs.
44
license: Apache-2.0
55
metadata:
66
author: Auth0 <support@auth0.com>
@@ -45,6 +45,7 @@ section heading (`### feature:mfa`) listing which reference files to load.
4545
| Build fully custom login/signup screens with your own code or framework, beyond what theme settings allow. *Auth0: Advanced Customization for Universal Login (ACUL).* | **feature:acul** |
4646
| Change how the login page looks — logo, colors, fonts, background, overall theme. *Auth0: branding, Universal Login customization.* | **feature:branding** |
4747
| Bind tokens to the client so a stolen or leaked token can't be reused/replayed from another machine. *Auth0: DPoP (Demonstrating Proof-of-Possession), sender-constrained tokens.* | **feature:dpop** |
48+
| Audit an existing Auth0 tenant for security & configuration issues and produce a report — run CheckMate, get a tenant configuration / platform development review, then optionally fix findings via the CLI. *Auth0: tenant audit, CheckMate.* | **audit** |
4849
| Ask for best practices, "is this secure?", how to handle tokens safely, "how should I do X". *Auth0: guidance / security.* | **guidance** |
4950
| Hit an error: 401 Unauthorized, 403 Forbidden, CORS, callback URL mismatch, redirect loop. *Auth0: debugging.* | **debug** |
5051
| Hit rate limiting: 429 Too Many Requests, quota exceeded. *Auth0: rate limits.* | **debug:rate-limit** |
@@ -339,6 +340,15 @@ Read: references/tooling-{tooling}.md
339340
If framework detected: Read references/framework-{framework}.md
340341
```
341342

343+
### audit
344+
```
345+
Read: references/feature-audit.md
346+
Read: references/feature-audit-pricing.md
347+
Read: references/feature-audit-remediation.md
348+
Read: references/tooling-{tooling}.md
349+
Apply findings only with per-command confirmation; verify each change by re-fetch.
350+
```
351+
342352
### upgrade-sdk
343353
```
344354
Read: references/framework-{framework}.md
Lines changed: 324 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,324 @@
1+
<!DOCTYPE html>
2+
<!--
3+
Locked HTML report template for the audit workflow (feature-audit reference).
4+
Phase 5 (report generation) substitutes every placeholder token with the same data feeding report-template.md.
5+
Visual design models the "Auth0 Platform Development Review" reference layout (orange brand accent, severity-coded chips, four-section structure).
6+
Render to PDF with scripts/render_pdf.sh (Chrome headless).
7+
-->
8+
<html lang="en">
9+
<head>
10+
<meta charset="utf-8">
11+
<title>Auth0 Platform Development Review — {{customer_name}}</title>
12+
<style>
13+
:root {
14+
--orange: #E94B1F;
15+
--orange-soft: #FCE9E2;
16+
--ink: #1A1A2E;
17+
--ink-soft: #4F4F66;
18+
--line: #E6E6EE;
19+
--bg: #FFFFFF;
20+
--severity-high: #C8260A;
21+
--severity-moderate: #C46B1D;
22+
--severity-low: #1F6FB5;
23+
--severity-pass: #1F8A4C;
24+
}
25+
@page {
26+
size: Letter;
27+
margin: 0.6in 0.7in 0.7in 0.7in;
28+
@bottom-right {
29+
content: "{{review_month_year}}";
30+
font: 9pt -apple-system, "Segoe UI", sans-serif;
31+
color: var(--ink-soft);
32+
}
33+
@bottom-left {
34+
content: "Confidential · Auth0 tenant configuration review for {{customer_name}}";
35+
font: 9pt -apple-system, "Segoe UI", sans-serif;
36+
color: var(--ink-soft);
37+
}
38+
}
39+
* { box-sizing: border-box; }
40+
html, body {
41+
margin: 0;
42+
padding: 0;
43+
color: var(--ink);
44+
background: var(--bg);
45+
font-family: -apple-system, "Inter", "Segoe UI", system-ui, sans-serif;
46+
font-size: 10.5pt;
47+
line-height: 1.45;
48+
}
49+
.header {
50+
display: flex;
51+
align-items: flex-start;
52+
justify-content: space-between;
53+
padding-bottom: 14pt;
54+
border-bottom: 3pt solid var(--orange);
55+
margin-bottom: 18pt;
56+
}
57+
.header h1 {
58+
font-size: 24pt;
59+
font-weight: 700;
60+
margin: 0 0 4pt 0;
61+
line-height: 1.15;
62+
}
63+
.header .subtitle {
64+
color: var(--ink-soft);
65+
font-size: 11pt;
66+
}
67+
.plan-badge {
68+
border: 1.5pt solid var(--orange);
69+
color: var(--orange);
70+
border-radius: 18pt;
71+
padding: 4pt 12pt;
72+
font-size: 10pt;
73+
font-weight: 600;
74+
white-space: nowrap;
75+
}
76+
.header-right {
77+
text-align: right;
78+
font-size: 10pt;
79+
color: var(--ink-soft);
80+
line-height: 1.5;
81+
}
82+
.header-right .plan-badge {
83+
display: inline-block;
84+
margin-bottom: 6pt;
85+
}
86+
.header-right .meta-line {
87+
display: block;
88+
color: var(--ink);
89+
}
90+
.meta-table {
91+
width: 100%;
92+
border-collapse: collapse;
93+
margin: 12pt 0 24pt 0;
94+
}
95+
.meta-table th, .meta-table td {
96+
text-align: left;
97+
padding: 10pt 12pt;
98+
border-bottom: 1pt solid var(--line);
99+
font-size: 10.5pt;
100+
}
101+
.meta-table th {
102+
width: 38%;
103+
color: var(--ink-soft);
104+
font-weight: 500;
105+
}
106+
.meta-table td {
107+
color: var(--ink);
108+
font-weight: 600;
109+
}
110+
h2.section {
111+
color: var(--orange);
112+
text-transform: uppercase;
113+
font-size: 11pt;
114+
letter-spacing: 0.05em;
115+
font-weight: 700;
116+
margin: 22pt 0 12pt 0;
117+
}
118+
table.data {
119+
width: 100%;
120+
border-collapse: collapse;
121+
margin: 8pt 0 18pt 0;
122+
}
123+
table.data th {
124+
text-align: left;
125+
text-transform: uppercase;
126+
font-size: 8.5pt;
127+
letter-spacing: 0.05em;
128+
color: var(--ink-soft);
129+
font-weight: 600;
130+
padding: 8pt 12pt;
131+
border-bottom: 1pt solid var(--line);
132+
}
133+
table.data td {
134+
padding: 11pt 12pt;
135+
border-bottom: 1pt solid var(--line);
136+
vertical-align: top;
137+
}
138+
table.data td.label {
139+
font-weight: 600;
140+
}
141+
.severity {
142+
display: inline-block;
143+
margin-right: 18pt;
144+
font-weight: 600;
145+
}
146+
.severity.high { color: var(--severity-high); }
147+
.severity.moderate { color: var(--severity-moderate); }
148+
.severity.low { color: var(--severity-low); }
149+
.severity.pass { color: var(--severity-pass); }
150+
.gap {
151+
border-left: 3pt solid var(--orange);
152+
padding: 4pt 0 4pt 14pt;
153+
margin: 12pt 0;
154+
}
155+
.gap .gap-name {
156+
font-weight: 700;
157+
margin-bottom: 4pt;
158+
}
159+
.gap p { margin: 0; }
160+
.opportunities th, .opportunities td {
161+
vertical-align: top;
162+
}
163+
.opportunities .feature { font-weight: 700; width: 18%; }
164+
.opportunities .challenge { width: 36%; color: var(--ink); }
165+
.opportunities .solution { width: 18%; color: var(--orange); font-weight: 600; }
166+
.opportunities .impact { width: 28%; color: var(--ink-soft); }
167+
.roadmap-banner {
168+
font-weight: 700;
169+
margin: 4pt 0 12pt 0;
170+
}
171+
.roadmap-banner em { color: var(--orange); font-style: normal; font-weight: 700; }
172+
.roadmap p { margin: 6pt 0; }
173+
.actions {
174+
list-style: none;
175+
counter-reset: action;
176+
padding: 0;
177+
margin: 6pt 0 16pt 0;
178+
}
179+
.actions li {
180+
counter-increment: action;
181+
display: flex;
182+
align-items: flex-start;
183+
margin: 6pt 0;
184+
}
185+
.actions li::before {
186+
content: counter(action);
187+
color: var(--ink-soft);
188+
font-weight: 600;
189+
width: 22pt;
190+
flex: 0 0 22pt;
191+
text-align: left;
192+
}
193+
.docs {
194+
display: grid;
195+
grid-template-columns: 1fr 1fr;
196+
gap: 8pt 12pt;
197+
margin: 8pt 0 0 0;
198+
}
199+
.docs a {
200+
display: block;
201+
padding: 10pt 14pt;
202+
border: 1pt solid var(--line);
203+
border-radius: 6pt;
204+
color: var(--orange);
205+
font-weight: 600;
206+
text-decoration: none;
207+
font-size: 10pt;
208+
}
209+
hr.section-divider {
210+
border: 0;
211+
border-top: 1pt solid var(--line);
212+
margin: 18pt 0;
213+
}
214+
.small { font-size: 9pt; color: var(--ink-soft); }
215+
</style>
216+
</head>
217+
<body>
218+
219+
<header class="header">
220+
<div>
221+
<h1>Auth0 Platform<br>Development Review</h1>
222+
{{subtitle_html}} <!-- a subtitle div reading "Prepared by <org>" if reviewer_org is non-empty; emit empty string otherwise -->
223+
</div>
224+
<div class="header-right">
225+
<span class="plan-badge">{{plan_tag}}</span>
226+
<span class="meta-line">{{customer_name}} · {{tenant_domain}}</span>
227+
<span class="meta-line">{{review_date_long}}</span>
228+
</div>
229+
</header>
230+
231+
<table class="meta-table">
232+
<tr><th>Prepared by</th><td>{{reviewer_name}}</td></tr>
233+
<tr><th>Date of Review</th><td>{{review_date_long}}</td></tr>
234+
<tr><th>Customer Account</th><td>{{customer_name}} ({{tenant_domain}})</td></tr>
235+
<tr><th>Current Auth0 Tier</th><td>{{tier}}</td></tr>
236+
<tr><th>Use Case Diagnosis</th><td>{{business_model}} — {{product_summary_short}}</td></tr>
237+
<tr><th>Recommended Plan</th><td>{{recommended_plan}} · Auth for AI Agents: {{a4aa_yes_no}}</td></tr>
238+
</table>
239+
240+
<h2 class="section">1. Account Health</h2>
241+
242+
<table class="data">
243+
<thead>
244+
<tr><th>Metric</th><th>Status</th></tr>
245+
</thead>
246+
<tbody>
247+
<tr><td class="label">Applications Registered</td><td>{{apps_count}}</td></tr>
248+
<tr><td class="label">Login Activity</td><td>{{login_activity}}</td></tr>
249+
<tr>
250+
<td class="label">Security Findings</td>
251+
<td>
252+
<span class="severity high">{{findings_high_count}} High</span>
253+
<span class="severity moderate">{{findings_moderate_count}} Moderate</span>
254+
<span class="severity low">{{findings_low_count}} Low / Info</span>
255+
<span class="severity pass">{{findings_passing_count}} Passing</span>
256+
</td>
257+
</tr>
258+
</tbody>
259+
</table>
260+
261+
<!-- gaps_html: rendered from the included gap callouts. Each block is a gap div with a
262+
gap-name heading and a one-line body paragraph. Only include gaps the data supports. -->
263+
{{gaps_html}}
264+
265+
<h2 class="section">2. Executive Summary</h2>
266+
267+
<p>{{exec_summary_paragraph}}</p>
268+
269+
<p><strong>Configuration Posture at a Glance</strong></p>
270+
271+
<table class="data">
272+
<thead>
273+
<tr><th>Severity</th><th>Count</th><th>Key Examples</th></tr>
274+
</thead>
275+
<tbody>
276+
<tr><td class="label" style="color:var(--severity-high)">High</td><td>{{findings_high_count}}</td><td>{{findings_high_examples}}</td></tr>
277+
<tr><td class="label" style="color:var(--severity-moderate)">Moderate</td><td>{{findings_moderate_count}}</td><td>{{findings_moderate_examples}}</td></tr>
278+
<tr><td class="label" style="color:var(--severity-low)">Low / Info</td><td>{{findings_low_count}}</td><td>{{findings_low_examples}}</td></tr>
279+
<tr><td class="label" style="color:var(--severity-pass)">Passing</td><td>{{findings_passing_count}} of {{findings_total_count}}</td><td>{{findings_passing_examples}}</td></tr>
280+
</tbody>
281+
</table>
282+
283+
<h2 class="section">3. Strategic Opportunities &amp; Action Plan</h2>
284+
285+
<table class="data opportunities">
286+
<thead>
287+
<tr><th>Feature Area</th><th>The Enterprise Challenge</th><th>The Solution</th><th>Strategic Impact</th></tr>
288+
</thead>
289+
<tbody>
290+
<!-- opportunities_rows: one table row per included row — feature area, a personalized
291+
challenge cell, the solution label, and the strategic impact. Every challenge cell
292+
MUST name a specific product, segment, or capability from the company context. -->
293+
{{opportunities_rows}}
294+
</tbody>
295+
</table>
296+
297+
<h2 class="section">4. Recommended Roadmap &amp; Next Steps</h2>
298+
299+
<p class="roadmap-banner">Recommended Plan: <em>{{recommended_plan}}{{a4aa_addon_suffix}}</em></p>
300+
301+
<div class="roadmap">
302+
{{plan_recommendation_paragraphs_html}}
303+
</div>
304+
305+
<p><strong>Immediate Actions — Available Today (Free)</strong></p>
306+
<ol class="actions">
307+
<!-- immediate_actions_html: one list item per item. Each must name affected apps/connections explicitly. -->
308+
{{immediate_actions_html}}
309+
</ol>
310+
311+
<p><strong>After Upgrading</strong></p>
312+
<ol class="actions">
313+
<!-- after_upgrading_html: one list item per item. -->
314+
{{after_upgrading_html}}
315+
</ol>
316+
317+
<p><strong>Key Documentation</strong></p>
318+
<div class="docs">
319+
<!-- docs_html: one anchor link per included row. Match Section 3 rows. -->
320+
{{docs_html}}
321+
</div>
322+
323+
</body>
324+
</html>

0 commit comments

Comments
 (0)