Repository navigation
Harden hosted issuer flows and support scoped application credentials - #30
Merged
Merged
Conversation
…onfiguration for refresh token issuance
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hosted applications need client-bound authorization codes, OIDC nonce preservation, scoped machine tokens, and per-request issuance controls before adopting Authly across multiple resources.
This change binds codes to their client and purpose, separates OIDC nonce from consent CSRF state, reads issuer/TTL configuration at issuance, preserves client-credentials scopes, and supports Basic authentication at the token endpoint. Trusted issuance options provide an explicit audience, expiry, scalar application claims, and optional refresh issuance. It also adds signing-key identifiers with retiring public keys, subject-backed UserInfo, a consent rendering hook, and configurable grant restrictions.
Compatibility: refresh_token is now nullable and omitted when disabled. Existing callers retain refresh issuance by default. Codes issued before this change lack the required client/type binding and must be restarted. Discovery now reports the configured issuer and only implemented client authentication methods.
Validation: Crystal 1.22.2; 598 examples, 0 failures/errors; formatting and git diff checks pass. Tests cover cross-client redemption, token-purpose confusion, nonce through consent/redemption, configured lifetimes, scope escalation, per-resource audiences, Basic authentication, disabled grants, key rotation, consent replay, and UserInfo subject binding.
JoobQUI production cutover remains gated on upstream review and application integration testing.