Dan MilneandClaude Opus 4.8 6c4be7199c Extract OidcScopes::SUPPORTED as the shared scope list ...

The supported-scope list lived on OidcController, so the device authorization
controller (and a test) had to reach across into OidcController::SUPPORTED_SCOPES.
Move it to a shared OidcScopes::SUPPORTED module — one source of truth for the
OIDC controller, the device flow, and consent handling — and update every
reference. No behavior change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Q4ATZHoMCWqvSpE2yYoie

2026-07-19 14:42:39 +10:00

..

concerns

Switch Access / Refresh tokens / Auth Code from bcrypt ( and plain ) to hmac. BCrypt is for low entropy passwords and prevents dictionary attacks - HMAC is suitable for 256-bit random data.

2025-12-31 15:48:32 +11:00

api_key.rb

Add API keys / bearer tokens for forward auth

2026-03-05 21:45:40 +11:00

application_group.rb

Clean up forward auth caching: remove duplication, fix rate limiting, and plug cache gaps

2026-03-21 23:54:19 +11:00

application_record.rb

First commit

2025-10-23 16:19:56 +11:00

application_user_claim.rb

StandardRB fixes

2026-01-01 13:29:44 +11:00

application.rb

Harden OIDC token endpoints from security review

2026-07-19 13:19:41 +10:00

current.rb

First crack

2025-10-23 16:45:00 +11:00

group.rb

Default-deny access control with group flags and access enumeration

2026-06-07 15:53:27 +10:00

oidc_access_token.rb

Device flow: replay-revocation, user_code CSPRNG, /device rate limit

2026-07-19 13:38:40 +10:00

oidc_authorization_code.rb

Revoke full token chain on OIDC authorization-code replay

2026-04-20 17:39:08 +10:00

oidc_device_code.rb

Device flow: replay-revocation, user_code CSPRNG, /device rate limit

2026-07-19 13:38:40 +10:00

oidc_refresh_token.rb

Device flow: replay-revocation, user_code CSPRNG, /device rate limit

2026-07-19 13:38:40 +10:00

oidc_scopes.rb

Extract OidcScopes::SUPPORTED as the shared scope list

2026-07-19 14:42:39 +10:00

oidc_user_consent.rb

Extract OidcUserConsent.record! upsert for shared consent

2026-07-19 13:59:44 +10:00

session.rb

Enforce account-active status across the auth lifecycle

2026-06-11 19:53:50 +10:00

setting.rb

Add OAuth device flow, token introspection, and dynamic client registration

2026-07-19 12:30:02 +10:00

svg_scrubber.rb

Add SvgScrubber to strip XSS payloads from uploaded app icons

2026-05-02 23:57:22 +10:00

user_group.rb

StandardRB fixes

2026-01-01 13:29:44 +11:00

user.rb

Enforce account-active status across the auth lifecycle

2026-06-11 19:53:50 +10:00

webauthn_credential.rb

Make WebAuthn clone detection actually block, and fix false positives

2026-06-11 20:28:38 +10:00