cliffhall
c8c050b51e
fix: require a recorded CIMD registration before preserving the kind ...
Copilot review (#2287 ): RFC 7591 §3.2 leaves a dynamically issued `client_id`
opaque, so `client_id === clientMetadataUrl` is not on its own proof that CIMD
ran — an authorization server could in principle mint that value from
`POST /register`.
Narrow the claim to a conjunction, whose decisive term is a registration we
recorded as CIMD ourselves rather than an inference about what the AS returned:
CIMD must be configured for this connection, the incoming `client_id` must be
exactly that metadata-document URL, and the registration already stored under
that id must be recorded as `cimd`. Everything else falls through to `dcr`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lmj6X2epWpPE7ScdSKQmtA
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-09-07 00:35:43 -04:00
Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage.
2026-07-04 21:56:45 -07:00
fix(oauth): persist the granted scope on every EMA mint
2026-08-25 01:32:40 -04:00
fix(auth): make the stuck-lock guidance conditional, not an instruction ( #2082 )
2026-08-23 12:49:06 -04:00
Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage.
2026-07-04 21:56:45 -07:00
feat: per-server custom OAuth authorization-request parameters ( #2018 )
2026-08-15 19:31:41 -04:00
fix(auth): pass the challenge's resource_metadata URL to SDK auth()
2026-08-24 19:48:40 -04:00
fix(oauth): keep the server's path in the fallback authorization-server URL
2026-08-26 00:03:40 -04:00
fix(auth): require JWT shape before trusting exp as proof of validity
2026-08-24 07:46:10 -04:00
fix(oauth): walk the candidates in the CLI refresh path too
2026-08-26 00:34:27 -04:00
perf(auth): gate the override wrapper on the discovery request, and guard disk values
2026-08-16 22:11:16 -04:00
fix(auth): floor the shared revocation budget instead of racing zero
2026-09-05 01:25:25 -04:00
fix(auth): explicit re-authorize when the OAuth callback state was lost ( #1808 ) ( #1810 )
2026-07-27 18:08:31 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
fix(auth): keep oauth-persist browser-safe (move Node file backend out)
2026-07-08 16:20:31 -04:00
fix: use Node storage in the revocation e2e, and drop the now-dead storage API ( #2144 )
2026-08-28 08:36:58 -04:00
fix(web): per-attempt snapshot ids, honest recovery copy, connect teardown
2026-08-29 02:32:05 -04:00
fix(auth): release discarded probe bodies, report the redirected source, proxy the CLI refresh
2026-08-28 02:35:27 -04:00
fix: require a recorded CIMD registration before preserving the kind
2026-09-07 00:35:43 -04:00
fix(auth): floor the shared revocation budget instead of racing zero
2026-09-05 01:25:25 -04:00
fix(oauth): filter the step-up scope union too, not just the provider
2026-08-24 23:05:14 -04:00
feat(web,core): enterprise-managed authorization (EMA) ( #1509 ) ( #1512 )
2026-06-24 22:15:12 -04:00
fix(auth): stop a config-only PUT deleting stored secrets ( #2084 )
2026-08-22 23:30:17 -04:00
fix: use Node storage in the revocation e2e, and drop the now-dead storage API ( #2144 )
2026-08-28 08:36:58 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
c8c050b51e