Repository navigation
fix: v0.21 OpenID Provider follow-ups and the external delivery subject - #571
Merged
Merged
Conversation
…vice token subject Refs #556
…al delivery A valid internal service token with any subject used to unlock external delivery. Only a token signed for seamless-auth-external-delivery does now. The conformance harness pin moves to seamless-cli v0.27.2, which mints that subject for delivery requests. Refs #556
…r expired_token Refs #542
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three v0.21 follow-ups. Each has a test commit that fails on
mainfirst, then the fix. The test commits were made with--no-verify, because the pre-commit hook runs coverage, which a deliberately failing test cannot pass; every fix commit went through the full hook.Closes #542
Closes #543
Closes #556 (part 2; parts 1 and 3 merged in #567)
The release PR is untouched; this ships with v0.23.0.
#556 part 2: require the external delivery subject
src/lib/externalDelivery.tsrequiressubto be exactlyseamless-auth-external-deliveryto unlock external delivery. Theit.failstest markedTODO(#556)is now a plainitand fails onmain. The conformance pin moves to seamless-cli v0.27.2 (28a363f), whose harness mints that subject.All four adapters already send that subject on every external delivery request (audited on Node
662b6aa, Gocee15df, Python3f8e828, Rustc096a97). Adopter-visible: a service token with any other subject no longer gets codes, links or notices back; the API sends them itself. Custom backends that mint their own delivery token must set thatsub.#542:
expired_tokenfor an expired device codefindOidcPayloadreads aDeviceCodeby id for 10 minutes past its expiry (DEVICE_CODE_EXPIRED_GRACE_MS), and the purge keeps those rows for the window. Every other model, the user-code and uid lookups, and consume still treat an expired row as gone, so an expired code can never be consumed. The window is a choice the issue left open.No edge adapter change is needed: oidc-provider loads the code with
ignoreExpirationand throwsExpiredTokenonisExpired. The edge-side tests are being added in the provider repo.#543: back-channel logout to the one application whose grant ends
destroyOidcPayload('Grant', id)now sends that grant's client a logout token for its session (newsendBackchannelLogoutForClient, claiming only thatsession:clientrow), unless another live grant still signs that client in on the session. The library's partial logout and itsrevoke()both destroy the grant this way, so "only sign out of this app" and library revocations are covered. The other application's row survives and the session stays live; a later full logout tells only the remaining app. Each app is told exactly once.Gap noted: the API has no admin or user route that revokes one application for a user; one added later should go through the same path.
Checks
lint, typecheck, format,
check:changeset-bump,generate:apiclean. Unit: 2840 passed, coverage 99.04% statements. Postgres suite: 183 of 184 files pass;oidcApplications.spec.ts > application resourcesfails with "Invalid system_config" on a fresh database, and fails the same way on a cleanmain.