cliffhall
2710c98681
fix: address Copilot review round 2 on #2319 ...
Both findings are on the caller-signal handling added in round 1:
- `"signal" in init` treated a member present as `undefined` as an
explicit override. `RequestInit` is a WebIDL dictionary, where such a
member converts as absent — so `{ ...base, signal: undefined }`, which
is what a spread over an options object with no signal produces, was
clearing a Request's embedded signal instead of inheriting it. Only a
non-`undefined` value overrides now; an explicit `null` is still the
genuine no-signal case.
- An already-aborted caller signal rejected the race, but
`Promise.race` still evaluated `fetchFn(...)`, so on the
signal-dropping proxy path the OAuth request went out anyway. It now
short-circuits before anything is constructed or sent, and the
now-unreachable aborted branch inside the race is gone.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFnM6RqB4nXqNysgUYmjmq
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-09-11 02:44:43 -04:00
Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage.
2026-07-04 21:56:45 -07:00
fix: delegate issuer context and discovery state through the EMA wrapper
2026-09-07 02:38:13 -04:00
fix(auth): make the stuck-lock guidance conditional, not an instruction ( #2082 )
2026-08-23 12:49:06 -04:00
Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage.
2026-07-04 21:56:45 -07:00
feat: per-server custom OAuth authorization-request parameters ( #2018 )
2026-08-15 19:31:41 -04:00
fix(auth): pass the challenge's resource_metadata URL to SDK auth()
2026-08-24 19:48:40 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
fix(auth): require JWT shape before trusting exp as proof of validity
2026-08-24 07:46:10 -04:00
fix(oauth): walk the candidates in the CLI refresh path too
2026-08-26 00:34:27 -04:00
perf(auth): gate the override wrapper on the discovery request, and guard disk values
2026-08-16 22:11:16 -04:00
feat: bound every OAuth-path request with a deadline
2026-09-11 00:45:04 -04:00
fix: the classifier does not survive structuredClone, and the test now proves it
2026-09-07 11:16:51 -04:00
fix(auth): explicit re-authorize when the OAuth callback state was lost ( #1808 ) ( #1810 )
2026-07-27 18:08:31 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
fix(auth): keep oauth-persist browser-safe (move Node file backend out)
2026-07-08 16:20:31 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
fix: usable IPv6 spelling, and drop a SEP label that means something else here (round 2)
2026-09-07 09:54:17 -04:00
fix(auth): release discarded probe bodies, report the redirected source, proxy the CLI refresh
2026-08-28 02:35:27 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
fix: address Copilot review round 2 on #2319
2026-09-11 02:44:43 -04:00
fix(auth): floor the shared revocation budget instead of racing zero
2026-09-05 01:25:25 -04:00
fix(oauth): filter the step-up scope union too, not just the provider
2026-08-24 23:05:14 -04:00
feat(web,core): enterprise-managed authorization (EMA) ( #1509 ) ( #1512 )
2026-06-24 22:15:12 -04:00
fix(auth): stop a config-only PUT deleting stored secrets ( #2084 )
2026-08-22 23:30:17 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
fix: read the SDK's own discovery state instead of a marker of our own
2026-09-07 02:03:12 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
2710c98681