What problem does it solve? Working on HFS authentication and authorization requires understanding how the helios-auth crate validates SMART-on-FHIR/OAuth2 JWT bearer tokens, enforces scopes, and resolves tenants, which is spread across many modules and environment variables. ## Core Features & Use Cases - JWT Bearer Validation: Configure JWKS-based token signature verification with issuer, audience, and algorithm checks via HFS_AUTH_* environment variables. - SMART v2 Scope Enforcement: Work with SmartScopePolicy, ScopeSet, and SmartPermissions to enforce scopes like system/Patient.rs. - SMART Discovery: Serve /.well-known/smart-configuration populated from HFS_SMART_* endpoint settings. - Use Case: When modifying token replay semantics or adding a new scope check in helios-auth, use this Skill to navigate config.rs, provider/, jwks/, scope/, and policy/ modules and understand why jti replay caching must not be reintroduced. ## Quick Start Ask the AI to help you modify or debug HFS authentication behavior, such as adding a new SMART scope check or configuring JWKS validation in the helios-auth crate.
