SecurityDept Documentation
SecurityDept is a reusable authentication and authorization stack. It has three deliverable layers:
- Rust crates for server-side verification, provider integration, auth contexts, and host configuration.
- TypeScript packages for browser, framework, and host-runtime auth clients.
- Reference applications that exercise the same contracts in an Axum server and a React web UI.
The repository README is the entry point. This page tells you which document owns a topic; it does not duplicate package API reference.
Choose A Path
Integrating Rust
Read Architecture for crate boundaries, then Auth Context and Modes for the product model. Each published crate has rustdoc as its API reference.
Integrating TypeScript
Read Client SDK Guide. It defines the public package families, the explicit environment contract, lifecycle expectations, and the distinction between public traits and internal RxJS composition.
Running The Reference Runtime
The executable baseline is apps/server plus apps/webui. Start with the root README and config.example.toml; Features lists the routes and capabilities it demonstrates.
Maintaining The Repository
- Release Automation owns versioning, metadata sync, package publishing, and release evidence.
- TS SDK Migrations records active breaking public-contract changes.
- Roadmap owns active scope and explicit deferrals.
- CHANGELOG records released history.
Documentation Ownership
| Topic | Authority |
|---|---|
| Repository entry and local development | README |
| Runtime and crate layering | Architecture |
| Capability availability | Features |
| Auth-context terminology and ownership | Auth Context and Modes |
| TypeScript package and host contracts | Client SDK Guide |
| Error responses and disclosure | Error System Design |
| Client-IP policy | Real-IP Strategy |
| Releases | Release Automation |
| Compatibility changes | TS SDK Migrations |
| Active priorities and deferrals | Roadmap |
| External integration evidence | Outposts |
Source And Rendered Docs
docs/en and docs/zh are the source documents. docsite/ is a VitePress render layer that links to those files; do not create a second copy of the content. Validate the site with just build-docs.
Package README files are generated by release-cli metadata sync. Keep package-specific contracts in rustdoc, TypeScript exports, and the focused documents above; do not hand-edit generated README content without updating the generator.
Documentation Rules
- Describe current behavior or an explicitly marked future plan, not internal historical narrative.
- Link to the public package/subpath or crate that owns a contract.
- Keep reference-app routes and composition code out of SDK contract claims.
- Update both English and Chinese source documents when changing user-facing project documentation.