3 Commits

Include renames

Author	SHA1	Message	Date
Dan MilneandClaude Opus 4.8	017dfdff0e	Harden OIDC token endpoints from security review ... Fixes from review of the device flow / introspection / DCR work: Introspection over-disclosure (RFC 7662): - Restrict introspection to authorized callers — the client a token was issued to, or a resource server registered (resource_identifiers) to serve the token's bound RFC 8707 audience. Unauthorized callers get {active:false}, disclosing nothing, instead of any confidential client reading any token. - Scope-gate disclosed claims: username only with the email scope, groups only with the groups scope (mirrors userinfo). ADR 0005. Tokens minted for revoked users: - Re-check application.user_allowed?(user) at mint time in the device, refresh, and authorization-code grants (covers app-active, user-active, group membership). A user deactivated or removed from the allowed group between approval and the token request is refused with access_denied. The refresh check runs before rotation so a denied refresh has no side effects. Device authorization hardening: - Require confidential clients to authenticate, and require PKCE (code_challenge) up front for clients that require it, so an intercepted device_code plus a known public client_id cannot redeem tokens. - Merge (not overwrite) the shared consent record on device approval. Tests: new oidc_introspection_test and oidc_mint_authorization_test; existing PKCE/claims tests updated to grant app access (they created ungrouped apps and relied on the token endpoint not checking authorization). Full suite green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F7cwhwDJp3MJJDoNPVE6zq	2026-07-19 13:19:41 +10:00
Dan MilneandClaude Opus 4.8	7149b98b7b	Add OAuth device flow, token introspection, and dynamic client registration ... Adds three OAuth surfaces to the OIDC provider so CLIs, terminal agents, and MCP connectors can authenticate as real users instead of using static API keys. Device Authorization Grant (RFC 8628): - OidcDeviceCode model (HMAC device_code, short plaintext user_code, nullable user until approval, slow_down polling state), mirroring OidcAuthorizationCode - POST /oauth/device_authorization issues the code pair + verification URIs - device_code grant on /oauth/token returns authorization_pending / slow_down / access_denied / expired_token, then the standard token triple; single-use - Authenticated /device approval page, gated by Application#user_allowed? Token Introspection (RFC 7662): - POST /oauth/introspect: confidential-caller-authenticated; returns active, scope, and the user's groups so resource servers can authorize on membership Dynamic Client Registration (RFC 7591): - POST /oauth/register creates public/confidential clients (PKCE required) - Runtime toggle via a new Setting store + admin switch on the Applications page; off by default, env var CLINCH_DCR_ENABLED as bootstrap fallback - New clients are default-deny (no allowed_groups) until an admin grants access - RFC 8414 metadata alias at /.well-known/oauth-authorization-server; registration_endpoint advertised only while the window is open Discovery advertises all three grants/endpoints. Seeds add a clinch-cli public client and a c2a2-introspection confidential client. ADRs in docs/decisions record the opaque-vs-JWT, device-flow, and DCR-security decisions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F7cwhwDJp3MJJDoNPVE6zq	2026-07-19 12:30:02 +10:00
Dan Milne	1ff0a95392	First commit	2025-10-23 16:19:56 +11:00