feat: configurable claim mapping for the JWT identity plugin - #31

Merged

araujof merged 28 commits into

praxis-proxy:mainfrom

araujof:feat/claim_mapping

Aug 23, 2026

Commits on Aug 21, 2026

feat(identity-jwt): add claim paths with backslash escaping
araujof
committed
983d506
test(identity-jwt): characterize the standard claim mapper against a token corpus
araujof
committed
3edc497
feat(identity-jwt): add the authored claim map and its compilation
araujof
committed
0685d00
feat(identity-jwt): add the mapper a compiled claim map drives
araujof
committed
5b244d2
feat(identity-jwt): ship standard, keycloak, auth0 and cognito presets
araujof
committed
004d605
feat(identity-jwt): route claim_mapper through the presets and accept claim_map
araujof
committed
0b8116e
test(identity-jwt): gate the standard preset against the Rust mapper
araujof
committed
ec41cc9
docs(identity-jwt): document the claim map and cover it end to end
araujof
committed
6fbdb0c
docs: record configurable claim mapping in the changelog
araujof
committed
c2f6b0c
fix(identity-jwt)!: close two standard-preset parity breaks
araujof
committed
bbd6dbc
fix(identity-jwt): escape a token-derived log value and un-vacuum the shape sweep
araujof
committed
0b68325
fix(identity-jwt): give each candidate flag one valid home, and derive the trust domain
araujof
committed
5acf020
docs: link the changelog entries to their pull request
araujof
committed
474bf26
docs: mark the claim-mapping plan completed
araujof
committed
a8a38c2
fix(identity-jwt)!: reject unknown keys in the resolver and issuer config
araujof
committed
f0a89e1
refactor(identity-jwt): close the review's coverage and surface residuals
araujof
committed
fb6826a
feat(identity-jwt)!: make the claims-bag overrides work with a preset
araujof
committed
3d3954c
Merge remote-tracking branch 'origin/main' into feat/claim_mapping
araujof
committed
f9b827a
fix(identity-jwt): satisfy the hardened lints from main
araujof
committed
58e0d36
docs: tighten the changelog entries
araujof
committed
d7b34d5
fix(identity-jwt)!: refuse a SPIFFE ID with no trust domain
araujof
committed
1549a88
fix(identity-jwt): name every claim in both override lists at once
araujof
committed
df8ae41
test(identity-jwt): stop the diagnostics capture racing the interest cache
araujof
committed
c601474

Commits on Aug 22, 2026

fix(identity-jwt): dedupe a union merge
araujof
committed
7c38c51
fix(identity-jwt): refuse a `claims` override that cannot apply
araujof
committed
4c7eb9c
perf(identity-jwt): render the miss diagnostics only when debug is on
araujof
committed
f2b3cfe

Navigation Menu

Uh oh!

feat: configurable claim mapping for the JWT identity plugin - #31

feat: configurable claim mapping for the JWT identity plugin#31
araujof merged 28 commits into
praxis-proxy:mainfrom
araujof:feat/claim_mapping

Commits on Aug 21, 2026

feat(identity-jwt): add claim paths with backslash escaping

test(identity-jwt): characterize the standard claim mapper against a token corpus

feat(identity-jwt): add the authored claim map and its compilation

feat(identity-jwt): add the mapper a compiled claim map drives

feat(identity-jwt): ship standard, keycloak, auth0 and cognito presets

feat(identity-jwt): route claim_mapper through the presets and accept claim_map

test(identity-jwt): gate the standard preset against the Rust mapper

docs(identity-jwt): document the claim map and cover it end to end

docs: record configurable claim mapping in the changelog

fix(identity-jwt)!: close two standard-preset parity breaks

fix(identity-jwt): escape a token-derived log value and un-vacuum the shape sweep

fix(identity-jwt): give each candidate flag one valid home, and derive the trust domain

docs: link the changelog entries to their pull request

docs: mark the claim-mapping plan completed

fix(identity-jwt)!: reject unknown keys in the resolver and issuer config

refactor(identity-jwt): close the review's coverage and surface residuals

feat(identity-jwt)!: make the claims-bag overrides work with a preset

Merge remote-tracking branch 'origin/main' into feat/claim_mapping

fix(identity-jwt): satisfy the hardened lints from main

docs: tighten the changelog entries

fix(identity-jwt)!: refuse a SPIFFE ID with no trust domain

fix(identity-jwt): name every claim in both override lists at once

test(identity-jwt): stop the diagnostics capture racing the interest cache

Commits on Aug 22, 2026

fix(identity-jwt): dedupe a union merge

fix(identity-jwt): refuse a `claims` override that cannot apply

perf(identity-jwt): render the miss diagnostics only when debug is on

Commits on Aug 23, 2026

docs(identity-jwt): say which merge mode the dedupe skips

fix(identity-jwt): report every bad override name at once