From 4e4857f8239d5bc322c62b62fdd24b909addfad7 Mon Sep 17 00:00:00 2001 From: luisrubiera Date: Sat, 10 Oct 2026 13:09:30 +0200 Subject: [PATCH] docs(roadmap): move shipped items to current capabilities and link epics The roadmap had not changed since 2026-04-10. Token exchange, session management, account lockout, organizations and self-service account security shipped in 0.9.0 but were still listed as planned. Move them to Current capabilities, add SAML, SSO sessions, durable webhooks, i18n and maintenance mode, and add the v0.10 epics (pagination, GDPR self-service, account chooser), pooled realms and the device grant to Next steps. Each started item links to its epic and shows its milestone. --- apps/website/src/lib/roadmap.ts | 138 ++++++++++++++++++++------- apps/website/src/pages/roadmap.astro | 18 +++- 2 files changed, 121 insertions(+), 35 deletions(-) diff --git a/apps/website/src/lib/roadmap.ts b/apps/website/src/lib/roadmap.ts index 8b7f59b..d7775c4 100644 --- a/apps/website/src/lib/roadmap.ts +++ b/apps/website/src/lib/roadmap.ts @@ -2,6 +2,8 @@ export interface RoadmapItem { title: string description: string status: 'available' | 'planned' | 'exploring' + link?: string + milestone?: string } export interface RoadmapColumn { @@ -11,6 +13,8 @@ export interface RoadmapColumn { items: RoadmapItem[] } +const issue = (number: number) => `https://github.com/ferriskey/ferriskey/issues/${number}` + export const roadmapColumns: RoadmapColumn[] = [ { key: 'now', @@ -21,16 +25,31 @@ export const roadmapColumns: RoadmapColumn[] = [ title: 'Realms and IAM objects', description: 'Manage realms, clients, users, roles, organizations, client scopes, and protocol mappers from the IAM surface.', status: 'available', + link: issue(851), }, { title: 'Identity federation', - description: 'Support OIDC, LDAP, and external identity providers for federated authentication scenarios.', + description: 'Act as an OIDC and SAML 2.0 identity provider, and federate with OIDC, LDAP, and social identity providers.', status: 'available', + link: issue(1260), }, { title: 'Authentication methods', - description: 'Cover Magic Link, Passkeys, reset password, TOTP, and core grant types including password, client credentials, and refresh token.', + description: 'Cover Magic Link, Passkeys, reset password, TOTP, and the password, client credentials, refresh token, and Token Exchange (RFC 8693) grant types.', + status: 'available', + link: issue(1050), + }, + { + title: 'Sessions and SSO', + description: 'Keep a login alive across applications with SSO sessions, and list or revoke active sessions through the session management API.', + status: 'available', + link: issue(1143), + }, + { + title: 'Account security', + description: 'Lock accounts after repeated failed logins, and let users manage their own password, TOTP, and passkeys.', status: 'available', + link: issue(1479), }, { title: 'Mail and token controls', @@ -39,8 +58,9 @@ export const roadmapColumns: RoadmapColumn[] = [ }, { title: 'Cloud-native deployment', - description: 'Ship with Helm, Docker, and Kubernetes support for platform-oriented deployments.', + description: 'Ship with Helm, Docker, and Kubernetes support, plus a maintenance mode for planned downtime.', status: 'available', + link: issue(927), }, { title: 'Audit and debugging modules', @@ -49,8 +69,15 @@ export const roadmapColumns: RoadmapColumn[] = [ }, { title: 'Events and permissions', - description: 'Expose webhooks and bitwise permissions for event-driven integrations and fine-grained IAM administration rights.', + description: 'Expose durable webhooks with a persistent outbox, retries, and delivery history, and bitwise permissions for fine-grained IAM administration rights.', status: 'available', + link: issue(1332), + }, + { + title: 'Localized admin console', + description: 'Store a locale per realm and per user, and serve the admin console in English, French, and Simplified Chinese.', + status: 'available', + link: issue(1351), }, ], }, @@ -59,6 +86,39 @@ export const roadmapColumns: RoadmapColumn[] = [ title: 'Next steps', description: 'The next product areas being shaped to make Ferriskey more complete and easier to operate.', items: [ + { + title: 'Server-side listings', + description: 'Paginate, sort, and filter every listing on the server so large realms stay fast in the console and the API.', + status: 'planned', + link: issue(1531), + milestone: 'v0.10', + }, + { + title: 'GDPR self-service', + description: 'Give users /me endpoints, personal data export, account deletion with a grace period, and consent management.', + status: 'planned', + link: issue(992), + milestone: 'v0.10', + }, + { + title: 'Account chooser', + description: 'Let a user pick between signed-in accounts on the login page, honouring prompt=select_account and login_hint.', + status: 'planned', + link: issue(671), + milestone: 'v0.10', + }, + { + title: 'Pooled realms', + description: 'Host many tenants as realms on one instance, with quotas and stronger tenant isolation semantics.', + status: 'planned', + link: issue(1610), + }, + { + title: 'Device authorization grant', + description: 'Support RFC 8628 so CLIs, TVs, and devices without a browser can sign in.', + status: 'planned', + link: issue(1020), + }, { title: 'Portal builder and auth flow', description: 'Build a configurable portal experience and a clearer way to define authentication journeys.', @@ -69,19 +129,14 @@ export const roadmapColumns: RoadmapColumn[] = [ description: 'Define and specify the dedicated authorization service before turning it into a stable product surface.', status: 'planned', }, - { - title: 'Organizations and sessions', - description: 'Add organization groups and a session management API for better administration of tenants, users, and active access.', - status: 'planned', - }, { title: 'Security hardening', - description: 'Introduce brute-force protection, rate limiting, OAuth 2.1 compliance, and Token Exchange support based on RFC 8693.', + description: 'Introduce rate limiting and OAuth 2.1 compliance.', status: 'planned', }, { - title: 'Account and client operations', - description: 'Deliver user self-service accounts, client evaluation tooling, and a CLI for operators and developers.', + title: 'Client operations', + description: 'Deliver client evaluation tooling and a CLI for operators and developers.', status: 'planned', }, { @@ -89,11 +144,6 @@ export const roadmapColumns: RoadmapColumn[] = [ description: 'Document and support migration paths from Supabase, Keycloak, Auth0, and other existing identity stacks.', status: 'planned', }, - { - title: 'Native multi-tenancy', - description: 'Move toward first-class multi-tenancy with quotas and stronger tenant isolation semantics.', - status: 'planned', - }, { title: 'Passwordless-first security', description: 'Explore device trust and device binding as first-class building blocks for passwordless authentication.', @@ -152,11 +202,19 @@ export const roadmapTranslations = { }, { title: "Fédération d'identité", - description: "Prendre en charge OIDC, LDAP et les identity providers externes pour les scénarios d'authentification fédérée.", + description: "Agir comme identity provider OIDC et SAML 2.0, et se fédérer avec des identity providers OIDC, LDAP et sociaux.", }, { title: "Méthodes d'authentification", - description: 'Couvrir Magic Link, Passkeys, reset password, TOTP et les grant types password, client credentials et refresh token.', + description: 'Couvrir Magic Link, Passkeys, reset password, TOTP et les grant types password, client credentials, refresh token et Token Exchange (RFC 8693).', + }, + { + title: 'Sessions et SSO', + description: "Garder une connexion active entre applications avec les sessions SSO, et lister ou révoquer les sessions actives via l'API de session management.", + }, + { + title: 'Sécurité des comptes', + description: 'Verrouiller un compte après des échecs de connexion répétés, et laisser les users gérer eux-mêmes leur mot de passe, TOTP et passkeys.', }, { title: 'Mails et contrôle des tokens', @@ -164,7 +222,7 @@ export const roadmapTranslations = { }, { title: 'Déploiement cloud-native', - description: 'Fournir le support Helm, Docker et Kubernetes pour les déploiements orientés plateforme.', + description: 'Fournir le support Helm, Docker et Kubernetes, ainsi qu\'un mode maintenance pour les interruptions planifiées.', }, { title: "Audit et modules de debug", @@ -172,7 +230,11 @@ export const roadmapTranslations = { }, { title: 'Événements et permissions', - description: "Exposer des webhooks et des permissions bitwise pour les intégrations événementielles et la gestion fine des droits d'administration IAM.", + description: "Exposer des webhooks durables avec outbox persistante, retries et historique de livraison, et des permissions bitwise pour la gestion fine des droits d'administration IAM.", + }, + { + title: 'Console admin localisée', + description: 'Stocker une locale par realm et par user, et servir la console admin en anglais, français et chinois simplifié.', }, ], }, @@ -180,6 +242,26 @@ export const roadmapTranslations = { title: 'Prochaines étapes', description: 'Les prochaines zones produit à construire pour rendre Ferriskey plus complet et plus simple à opérer.', items: [ + { + title: 'Listes côté serveur', + description: "Paginer, trier et filtrer chaque liste côté serveur pour que les gros realms restent rapides dans la console et l'API.", + }, + { + title: 'Self-service RGPD', + description: "Donner aux users des endpoints /me, l'export de leurs données personnelles, la suppression de compte avec délai de grâce et la gestion des consentements.", + }, + { + title: 'Sélecteur de compte', + description: 'Laisser un user choisir entre ses comptes connectés sur la page de login, en respectant prompt=select_account et login_hint.', + }, + { + title: 'Pooled realms', + description: 'Héberger de nombreux tenants comme realms sur une seule instance, avec quotas et une isolation plus explicite des tenants.', + }, + { + title: 'Device authorization grant', + description: 'Supporter la RFC 8628 pour que les CLI, TV et appareils sans navigateur puissent se connecter.', + }, { title: 'Portal builder et auth flow', description: "Construire une expérience portail configurable et une manière plus claire de définir les parcours d'authentification.", @@ -188,26 +270,18 @@ export const roadmapTranslations = { title: "Service d'autorisation", description: "Définir et spécifier le service d'autorisation dédié avant d'en faire une surface produit stable.", }, - { - title: 'Organisations et sessions', - description: "Ajouter les organization groups et une API de session management pour mieux administrer les tenants, users et accès actifs.", - }, { title: 'Durcissement sécurité', - description: 'Introduire la brute-force protection, le rate limiting, la compliance OAuth 2.1 et Token Exchange selon la RFC 8693.', + description: 'Introduire le rate limiting et la compliance OAuth 2.1.', }, { - title: 'Opérations compte et client', - description: 'Livrer un portail self-service user, un outil Evaluate client et une CLI pour les opérateurs et développeurs.', + title: 'Opérations client', + description: 'Livrer un outil Evaluate client et une CLI pour les opérateurs et développeurs.', }, { title: 'Stratégies de migration', description: 'Documenter et supporter les chemins de migration depuis Supabase, Keycloak, Auth0 et autres stacks identity existantes.', }, - { - title: 'Multi-tenancy natif', - description: 'Aller vers un multi-tenancy de premier niveau avec quotas et une isolation plus explicite des tenants.', - }, { title: 'Sécurité passwordless-first', description: "Explorer Device Trust et Device Binding comme briques centrales de l'authentification passwordless.", diff --git a/apps/website/src/pages/roadmap.astro b/apps/website/src/pages/roadmap.astro index 1c15710..f0d52a5 100644 --- a/apps/website/src/pages/roadmap.astro +++ b/apps/website/src/pages/roadmap.astro @@ -124,11 +124,23 @@ const columnAccent = {

{item.title}

- - {item.status} - +
+ {item.milestone && ( + + {item.milestone} + + )} + + {item.status} + +

{item.description}

+ {item.link && ( + + #{item.link.split('/').pop()} + + )}
))}