# Auth.md

> Authoritative Machine-Readable Authentication, Registration & API Access Policy for AI Agents interacting with [The Unknown Film Company](https://www.theunknownfilmcompany.com).
> Conforms to the WorkOS Auth.md specification (https://workos.com/auth-md) and RFC 9728 / RFC 8414 / RFC 9727 standards.

---

## Agent Registration

AI agents and automated workloads seeking access to protected endpoints or elevated rate limits can register via the following mechanisms:

1. **Automated Registration**: Review OAuth 2.0 Authorization Server metadata at [`/.well-known/oauth-authorization-server`](https://www.theunknownfilmcompany.com/.well-known/oauth-authorization-server) and OpenID Connect Discovery at [`/.well-known/openid-configuration`](https://www.theunknownfilmcompany.com/.well-known/openid-configuration).
2. **Institutional & Production Grants**: Submit inquiries via [`/contact`](https://www.theunknownfilmcompany.com/contact) specifying the agent identity, use case, organization, and required scopes.
3. **Public Read-Only Access**: No registration or credentials required for public retrieval endpoints (see section below).

---

## Supported Identity Types

The Unknown Film Company supports the following agent identity models:

- `agent`: Autonomous software agents acting on behalf of an end-user or autonomous system.
- `workload`: Automated CI/CD pipelines, cron jobs, and background crawlers.
- `service_account`: Cloudflare Workers, edge microservices, and partner institutional platforms.

---

## Supported Credential Types

- `jwt_bearer`: Cryptographically signed JSON Web Tokens (Cloudflare Zero Trust Access JWTs or OAuth 2.0 Bearer tokens).
- `api_key`: Custom API token headers passed via `Authorization: Bearer <token>`.
- `session_cookie`: 24-hour HTTP-Only, `SameSite=Strict`, `Secure` PBKDF2 HMAC signed session cookie (`tufc_admin_session`).

---

## OAuth 2.0 & OpenID Connect Discovery Endpoints

- **OAuth 2.0 Authorization Server (RFC 8414)**: [`/.well-known/oauth-authorization-server`](https://www.theunknownfilmcompany.com/.well-known/oauth-authorization-server)
- **OpenID Connect Discovery 1.0**: [`/.well-known/openid-configuration`](https://www.theunknownfilmcompany.com/.well-known/openid-configuration)
- **OAuth Protected Resource (RFC 9728)**: [`/.well-known/oauth-protected-resource`](https://www.theunknownfilmcompany.com/.well-known/oauth-protected-resource)
- **JSON Web Key Set (JWKS)**: [`/.well-known/jwks.json`](https://www.theunknownfilmcompany.com/.well-known/jwks.json)

---

## Public Read-Only Access (Zero Auth Required)

The following resources are open for AI indexing, search evaluation, and semantic retrieval:

- **AI Summaries & Manifests**:
  - `/llms.txt` — Structured Markdown overview of the company, the documentary *Roshni: Ray of Light*, director Nazneen, awards, and reviews.
  - `/llms-full.txt` — Full aggregated corpus for deep contextual grounding.
  - `/.well-known/ai-catalog.json` — Agentic Resource Discovery (ARD) capability manifest.
  - `/.well-known/api-catalog` — RFC 9727 API catalog.
  - `/.well-known/mcp/server-card.json` — SEP-1649 MCP Server Card.
  - `/.well-known/agent-skills/index.json` — Agent Skills Discovery Index.
- **Model Context Protocol (MCP)**:
  - `POST /api/mcp` & `GET /api/mcp` — Open JSON-RPC 2.0 endpoint for querying film data, awards, soundtrack information, and press kits.
- **Public Website Pages**:
  - `/`, `/about-us`, `/film-appreciation`, `/contact`, `/roshni-ray-of-light-now-streaming`, `/roshni-ray-light-soundtrack`, `/roshni-documentary-video-excerpts`.
  - Content negotiation: Sending `Accept: text/markdown` on any public page returns clean, LLM-optimized Markdown with `x-markdown-tokens` headers.

---

## Public Interactive Actions & Bot Verification

- **Contact Form Inquiries (`POST /api/contact`)**:
  - Requires a valid Cloudflare Turnstile bot verification token (`turnstileToken`) in the payload.
  - Enforces Cloudflare Edge rate limiting: Maximum **5 submissions per 60 seconds per IP**.
  - Verified inquiries are securely routed to the production team.

---

## Protected Administrative Operations & Security Isolation

- **Admin Dashboard (`/admin/*`) and Admin APIs (`/api/admin/*`)**:
  - **Strictly Protected**: Not accessible without verified credentials.
  - Authentication requires either:
    1. Cryptographically verified **Cloudflare Zero Trust Access JWT** assertions (`Cf-Access-Jwt-Assertion`).
    2. Encrypted, HTTP-only, `SameSite=Strict`, `Secure` admin session cookies (`tufc_admin_session`).
  - Database backups (`/api/admin/backups`) are encrypted using **AES-256-GCM** with PBKDF2 key derivation (100,000 iterations).

---

## Contact & Security Vulnerability Disclosure

- **Production House**: The Unknown Film Company
- **General Inquiries**: [info@theunknownfilmcompany.com](mailto:info@theunknownfilmcompany.com)
- **Security Vulnerability Reporting**: [security@theunknownfilmcompany.com](mailto:security@theunknownfilmcompany.com)
- **Security TXT**: [`/.well-known/security.txt`](https://www.theunknownfilmcompany.com/.well-known/security.txt)