clinch

Files

T

Dan MilneandClaude Opus 4.8 e3f0bd4cab Extract OidcUserConsent.record! upsert for shared consent

The consent record is unique on user+application and shared between the browser
authorization flow and device-flow approval. Centralize the upsert in
OidcUserConsent.record!(merge:) so a narrower device request unions its scopes
into any existing grant (merge: true) rather than overwriting it and wiping
stored claims, while the browser consent screen records exactly the approved
scopes (merge: false). scopes is now nil-safe for not-yet-saved records.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F7cwhwDJp3MJJDoNPVE6zq

2026-07-19 13:59:44 +10:00

concerns

Switch Access / Refresh tokens / Auth Code from bcrypt ( and plain ) to hmac. BCrypt is for low entropy passwords and prevents dictionary attacks - HMAC is suitable for 256-bit random data.

2025-12-31 15:48:32 +11:00

api_key.rb

Add API keys / bearer tokens for forward auth

2026-03-05 21:45:40 +11:00

application_group.rb

Clean up forward auth caching: remove duplication, fix rate limiting, and plug cache gaps

2026-03-21 23:54:19 +11:00

application_record.rb

First commit