Static assets loaded from resources

Currently we're hard-coding specific asset routes. This isn't really scalable,
but we shouldn't need many of them, and it means we don't end up serving
things off the classpath or filesystem which we didn't intend to serve.

Authentication endpoints. Login, logout, etc.

Front page, some basic account management for the user

JSON Web Key Set

Standard discoverable endpoint so third parties can validate our JWT tokens.

OAuth 2.1 authorization and token exchange

OpenID connect implementation

These are only the OIDC-specific endpoints like discovery or userinfo. Much of
the OIDC logic lives inside the OAuth2 implemenation.

Standard API description

reverse proxy to load resources from 3rd website

2FA endpoints.
- generate secret, store in session, show QR code
- user adds it to their authenticator app
- ask user for code from authenticator
- if code is valid, store secret as credential, remove from session

Implementation of the oakadm CLI

Command line interface for various administrative tasks.

Configuration and system setup, mostly wrappers around lambdaisland.config and
makina.

Database schema

We automatically create missing tables/columns/indices when the database
connection pool boots base on what's here.

Backup code that used together with 2FA

Store credentials, like password hashes, authenticator app codes, OTP codes,
nonces for passwordless login, API keys, etc

An identifier identifies an identity

Email, phone number, etc

Identity entity, can be a human identity, or non-human identity

Domain layer for working with JWKs

Utility functions for creating/handling JWTs and JWT claims.

Both access tokens and ID tokens.

Authorizations that have been granted through OAuth

Domain layer for oauth-client entities

Codes that can be exchanged in an oauth flow

Refresh tokens for OAuth flow

Form components

SVGs

Global CSS declarations

Generic components

Middleware which populates the :identity key in the request based on Bearer
token or session

These need to be added to the (group of) route(s) that need them. If they are
routes end-users access in their browser, session-auth makes sense. If they
are routes the relying party calls with a bearer token, then bearer-auth makes
sense. Routes that don't need these should not have them.

Automatic database schema evolution utilities

lambdaisland/cli middleware for convenient and pretty error handling

Convenience functions for next.jdbc/honeysql

Default to returning kebab-cased qualified maps.

Handle (outgoing) email

Monkey patch Hato to read/write JSON using Charred

Wrapper around password4j that can detect the hash type based on the Modular
Crypt Format (MCF) prefix.

Pepper and other settings can be configured through Password4j's own mechanisms,
`-J-Dpsw4j.configuration=/my/path/to/password4j.properties`

PostgreSQL JSONB type handling for next.jdbc

Middleware that sets a CSP policy.

CSP policy is configured through `:http/csp-policy`. The special value `nonce`
is replaced with `nonce-<per-request-generated-nonce>`, which can be accessed
through `*csp-nonce*`

Handle time format

A library generate, verify time-based one time passwords for
Multi-Factor Authentication.

PostgreSQL connection pool + JSONB setup

HTTP handler, Ring-based

HTTP server component

Memory-based session store, used for testing

Global middleware, executes before reitit matches the request

Redis component

HTTP router and middleware setup

Allow adding Java security providers through configuration

E.g. you might want to set BouncyCastle as the default, for FIPS Compliance.

Config keys: `:java.security.provider/prepend` /
`:java.security.provider/append`. Both take a collection of strings, which are
either a class name (assuming a zero-arg constructor), or
className/methodName, assuming a zero-arg static method for
initialization (e.g. Conscrypt)

Convert between base64 and byte-arrays

Regular and URL varieties

Unopinioted BigInteger helpers

Generic hashing utilities

A data-driven wrapper around nimbus-jose-jwt for Clojure.

Works with string-string maps.

Provides a structured, key-value logging interface on top of Log4j2.
Inspired by pedestal.log and lambdaisland.glogi.

Usage:
  (require '[co.gaiwan.oak.util.log :as log])

  (log/info :app/starting {:port 8080 :env :prod})
  (try
    (/ 1 0)
    (catch Exception e
      (log/error :db/query-failed :query "SELECT * FROM users" :exception e)))

Built to work with structured output, in particular JsonLayout 

Generate (secure) random things

Helpers related to the reitit router/routing

UUID conversion functions

OAuth server implementation tester

Command line interface for testing OAuth server implementations.

OAuth tester tool implementation