Dan MilneandClaude Opus 4.8
2defa26a87
Clients can name a target resource server via the `resource` parameter at the authorization and device-authorization endpoints. Clinch binds it to the issued token as its audience and reports it at introspection as `aud`, so a token minted for one API cannot be replayed against another that also trusts clinch. - `resource` is validated syntax-only (absolute URI, no fragment) — pass-through, no resource registry; the resource server enforces the audience on introspection - threaded from authorize / device_authorization onto the auth/device code, then the access and refresh tokens, and carried across refresh rotation - invalid values are rejected with error=invalid_target - introspection `aud` is the bound resource, falling back to the client_id - ADR 0004 records the pass-through-vs-registry decision Completes the clinch-side OAuth surface for MCP connectors (with DCR + introspection); Protected Resource Metadata (RFC 9728) lives on the resource server. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F7cwhwDJp3MJJDoNPVE6zq
13 lines
591 B
Ruby
13 lines
591 B
Ruby
class AddResourceToOidcTokens < ActiveRecord::Migration[8.1]
|
|
# RFC 8707 Resource Indicators: the audience (target resource server) a token
|
|
# is bound to. Threaded from the authorize / device_authorization request
|
|
# through the code and carried across refresh rotation onto the access token,
|
|
# where introspection reports it as `aud`.
|
|
def change
|
|
add_column :oidc_authorization_codes, :resource, :string
|
|
add_column :oidc_device_codes, :resource, :string
|
|
add_column :oidc_access_tokens, :resource, :string
|
|
add_column :oidc_refresh_tokens, :resource, :string
|
|
end
|
|
end
|