Add edge-sso template and workflows, rebuilt off main

[godronus]

Rebuilt the SSO delivery branch cleanly on top of main instead of the stale feature/saml-app branch:

• edge-sso/ template (canonical version from feature/totp-app, which is a strict superset of feature/saml-app's edge-sso)
• Split publish-sso-*.yml workflows (gate-only/cookie/header x auth/filter)
• test-edge-sso.yml
• Rename shared reusable _publish.yml -> _publish_rs.yml, add _publish_js.yml for TS auth-apps; harden-cookies/html2md updated to match
• Updated read-template-registry action

Excludes all edge-totp content so this can merge to main independently of feature/totp-app.

[Copilot]

Pull request overview

Adds a new edge-sso/ standalone template (TS auth-app + Rust proxy-wasm CDN filters) that provides multi-provider SSO across three delivery variants (gate-only / cookie / header), plus CI/test and publish workflows to build, test, and deploy the new templates through the existing portal pipeline.

Changes:

• Introduces edge-sso/ monorepo workspace with shared TS core (@sso/core) and shared Rust filter library (sso-guard), plus per-variant template packaging.
• Adds extensive unit/integration/e2e/filter test suites for the SSO flow and security invariants (redirect validation, token signing/verification, OIDC nonce binding, etc.).
• Adds new CI workflow (test-edge-sso.yml) and splits publish workflows per edge-sso artifact, alongside reusable _publish_rs.yml / _publish_js.yml workflows and an updated read-template-registry action.

Reviewed changes

Copilot reviewed 111 out of 113 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
edge-sso/tsconfig.base.json	Base TS config shared by edge-sso packages.
edge-sso/templates/header/cdn-filter/src/lib.rs	Proxy-wasm entrypoint wiring for the header variant filter.
edge-sso/templates/header/cdn-filter/registry.json	Portal metadata + params for the header CDN filter template.
edge-sso/templates/header/cdn-filter/package.json	Build/test scripts for header filter packaging.
edge-sso/templates/header/cdn-filter/Cargo.toml	Header filter crate config + feature selection on shared filter.
edge-sso/templates/header/cdn-filter/.env.example	Header filter configuration reference for portal/local use.
edge-sso/templates/header/auth-app/tsconfig.json	TS config for header auth-app build.
edge-sso/templates/header/auth-app/tests/app.test.ts	Variant smoke test for header auth-app.
edge-sso/templates/header/auth-app/server.tsx	Header auth-app entrypoint preset using @sso/core.
edge-sso/templates/header/auth-app/package.json	Build/test scripts and deps for header auth-app.
edge-sso/templates/header/auth-app/.env.example	Header auth-app configuration reference.
edge-sso/templates/gate-only/cdn-filter/src/lib.rs	Proxy-wasm entrypoint wiring for gate-only filter.
edge-sso/templates/gate-only/cdn-filter/registry.json	Portal metadata + params for gate-only CDN filter template.
edge-sso/templates/gate-only/cdn-filter/package.json	Build script for gate-only filter packaging.
edge-sso/templates/gate-only/cdn-filter/Cargo.toml	Gate-only filter crate config + feature selection on shared filter.
edge-sso/templates/gate-only/cdn-filter/.env.example	Gate-only filter configuration reference.
edge-sso/templates/gate-only/auth-app/tsconfig.json	TS config for gate-only auth-app build.
edge-sso/templates/gate-only/auth-app/tests/app.test.ts	Variant smoke test for gate-only auth-app.
edge-sso/templates/gate-only/auth-app/server.tsx	Gate-only auth-app entrypoint preset using @sso/core.
edge-sso/templates/gate-only/auth-app/package.json	Build/test scripts and deps for gate-only auth-app.
edge-sso/templates/gate-only/auth-app/.env.example	Gate-only auth-app configuration reference.
edge-sso/templates/cookie/cdn-filter/tests/filter.test.ts	Cookie filter acceptance suite runner (gate/aud-iss/fail-closed/alg pinning).
edge-sso/templates/cookie/cdn-filter/src/lib.rs	Proxy-wasm entrypoint wiring for cookie filter.
edge-sso/templates/cookie/cdn-filter/registry.json	Portal metadata + params for cookie CDN filter template.
edge-sso/templates/cookie/cdn-filter/package.json	Build/test scripts for cookie filter packaging.
edge-sso/templates/cookie/cdn-filter/Cargo.toml	Cookie filter crate config + ES256 feature selection.
edge-sso/templates/cookie/cdn-filter/.env.example	Cookie filter configuration reference.
edge-sso/templates/cookie/auth-app/tsconfig.json	TS config for cookie auth-app build.
edge-sso/templates/cookie/auth-app/tests/unit/session-token.test.ts	Unit tests for token signing/verification + SAML request binding.
edge-sso/templates/cookie/auth-app/tests/unit/saml-claims.test.ts	Unit tests for SAML attribute-to-claim extraction/mapping.
edge-sso/templates/cookie/auth-app/tests/unit/redirect.test.ts	Unit tests for open-redirect hardening.
edge-sso/templates/cookie/auth-app/tests/unit/providers-registry.test.ts	Unit tests for provider allowlist/selection + login URL building.
edge-sso/templates/cookie/auth-app/tests/unit/oauth-common.test.ts	Unit tests for PKCE/state signing/verified email helper.
edge-sso/templates/cookie/auth-app/tests/unit/microsoft-oidc.test.ts	Unit tests for Microsoft id_token verification (incl. tenant allowlist).
edge-sso/templates/cookie/auth-app/tests/unit/google-oidc.test.ts	Unit tests for Google id_token verification (incl. nonce binding).
edge-sso/templates/cookie/auth-app/tests/unit/default-claims.test.ts	Unit tests for parsing SSO_CLAIMS.
edge-sso/templates/cookie/auth-app/tests/tsconfig.json	Dedicated TS config for Node-run unit tests.
edge-sso/templates/cookie/auth-app/tests/non-cookie-smoke.ts	Shared smoke test for non-cookie variants.
edge-sso/templates/cookie/auth-app/tests/_cookies.ts	Helper to normalize multi-valued set-cookie behavior.
edge-sso/templates/cookie/auth-app/server.tsx	Cookie auth-app entrypoint preset using @sso/core.
edge-sso/templates/cookie/auth-app/package.json	Build/test scripts and deps for cookie auth-app.
edge-sso/templates/cookie/auth-app/.env.test	Safe committed test fixture env for integration/e2e.
edge-sso/templates/cookie/auth-app/.env.example	Cookie auth-app configuration reference.
edge-sso/scripts/gen-ec-keypair.mjs	Helper script to generate ES256 keypair and print PEM/JWK material.
edge-sso/README.md	Public-facing overview + variant/config docs for edge-sso template.
edge-sso/pnpm-workspace.yaml	pnpm workspace + dependency catalog for edge-sso packages.
edge-sso/package.json	Workspace root scripts (build/test).
edge-sso/LICENSE	Template license.
edge-sso/core/util/env.ts	Runtime helpers for required env/secret access.
edge-sso/core/util/bytes.ts	Encoding helpers (utf8/base64/base64url).
edge-sso/core/tsconfig.json	TS config for @sso/core.
edge-sso/core/session/token.ts	JWT token mint/verify + SAML request binding utilities.
edge-sso/core/session/key.ts	Variant-specific signing key/secret resolution.
edge-sso/core/package.json	@sso/core package exports surface.
edge-sso/core/filter/Cargo.toml	Shared Rust filter crate deps + feature flags.
edge-sso/core/federation/util/redirect.ts	Redirect validation (open-redirect + response-splitting defenses).
edge-sso/core/federation/saml/request.ts	SAML AuthnRequest generation + deflate/base64 encoding.
edge-sso/core/federation/saml/handlers.ts	SAML login/callback handlers incl. request binding + relay cookie.
edge-sso/core/federation/saml/config.ts	SAML config resolution from env/secrets.
edge-sso/core/federation/saml/claims.ts	SAML attribute extraction + optional mapping parsing.
edge-sso/core/federation/providers/registry.ts	Provider registry + selection + login URL builder.
edge-sso/core/federation/providers/microsoft-oidc.ts	Microsoft id_token verification logic.
edge-sso/core/federation/providers/google.ts	Google OIDC login/callback implementation.
edge-sso/core/federation/providers/google-oidc.ts	Google id_token verification logic.
edge-sso/core/federation/providers/facebook.ts	Facebook OAuth login/callback implementation.
edge-sso/core/federation/providers/common.ts	Shared OAuth helpers (PKCE/state signing/verified email).
edge-sso/core/federation/index.ts	@sso/core public exports for federation surface.
edge-sso/core/federation/error.tsx	Generic error page UI.
edge-sso/core/federation/config.ts	Runtime config resolution (providers, allowlist, iss/aud, branding).
edge-sso/core/federation/app.tsx	Hono app wiring for /auth/** routes + JWKS route (cookie-only).
edge-sso/context/INDEX.md	Context index for design/architecture/testing docs.
edge-sso/context/development/testing.md	Test inventory + how-to-run + CI wiring documentation.
edge-sso/context/design/integration.md	Consumer integration guide for auth surface + redirect handling.
edge-sso/context/architecture/security.md	Security posture and known limitations.
edge-sso/context/architecture/saml-flow.md	SAML flow documentation and verification checklist.
edge-sso/context/architecture/runtime-constraints.md	StarlingMonkey constraints + viable SAML stack notes.
edge-sso/context/architecture/overview.md	Architecture overview and token/config model.
edge-sso/context/architecture/auth-modes.md	Explanation of the three delivery templates.
edge-sso/CLAUDE.md	Project-specific agent/context doc for edge-sso subtree.
edge-sso/Cargo.toml	Rust workspace definition for shared filter + per-variant crates.
edge-sso/AGENTS.md	Edge-sso subtree agent rules reference.
edge-sso/.gitignore	Ignore rules for deps/artifacts/env files.
edge-sso/.cargo/config.toml	Rust build target config (wasm32-wasip1).
.github/workflows/test-edge-sso.yml	CI workflow to build + test edge-sso templates.
.github/workflows/publish-sso-header-filter.yml	Publish workflow for header CDN filter template.
.github/workflows/publish-sso-header-auth.yml	Publish workflow for header auth-app template.
.github/workflows/publish-sso-gate-only-filter.yml	Publish workflow for gate-only CDN filter template.
.github/workflows/publish-sso-gate-only-auth.yml	Publish workflow for gate-only auth-app template.
.github/workflows/publish-sso-cookie-filter.yml	Publish workflow for cookie CDN filter template.
.github/workflows/publish-sso-cookie-auth.yml	Publish workflow for cookie auth-app template.
.github/workflows/publish-html2md.yml	Switches html2md publishing to _publish_rs.yml + adds permissions.
.github/workflows/publish-harden-cookies.yml	Switches harden-cookies publishing to _publish_rs.yml + adds permissions.
.github/workflows/_publish_rs.yml	New reusable Rust template publish workflow (parametrized paths).
.github/workflows/_publish_js.yml	New reusable JS/TS template publish workflow.
.github/read-template-registry/action.yaml	Makes template_id optional + instructions.md optional.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.