docs(19.4): security review

ASVS L1 walk over the wristband OIDC flavour, sm-oauthserver-plugin and the
sm-user-plugin additions. T-19.4-01..34 and T-19.4-SC verified or fixed (test
pins in summercms.go eaa545c and sm-oauthserver-plugin b4223be, f8eaf70);
new findings T-19.4-36..39 accepted with reasons; nothing left unresolved.

.planning/phases/19.4-oidc-provider-on-wristband/19.4-SECURITY-REVIEW.md

@@ -0,0 +1,114 @@
+# Phase 19.4 Security Review: OIDC provider on wristband
+
+**Date:** 2026-10-19
+**Level:** OWASP ASVS L1 (RESEARCH "Security Domain")
+**Scope:** wristband's OIDC flavour (`summercms.go/modules/wristband/oidc_*.go` plus the flavour and kind checks in `authorize.go` and `token.go`), the new plugin `sm-oauthserver-plugin` (stores, key ring, host and pages, admin screens, commands, import, parity fixtures), and the sm-user-plugin additions (`RequestUser`, `EndRequestSession`, `AvatarURL`, `user.Deactivating`).
+**Threats reviewed:** T-19.4-01..T-19.4-34 and T-19.4-SC from the threat models of plans 01, 02 and 03. T-19.4-35 belongs to plan 04's gate script, which does not exist yet; plan 04 reviews it.
+**Result:** every threat is verified or fixed; four new findings (T-19.4-36..T-19.4-39) are accepted with reasons. No threat is left unresolved.
+
+Repositories and abbreviations used below: **W** = `summercms.go/modules/wristband`, **P** = `sm-oauthserver-plugin`, **U** = sm-user-plugin (`fonoteka.go/plugins/golem15/user`).
+
+## Method
+
+1. For each threat, read the code that implements the mitigation and record the file and line (grep-level check at L1, plus a read of the surrounding logic).
+2. For each threat, find the test that pins the mitigation. Where the code was correct but no test pinned it, add the test as a separate commit in the repository it belongs to (no production code needed changing).
+3. Cross-cutting sweeps: log and error paths, `no-store` on every credential-carrying response, consent replay, kind isolation, the cabana surface, branding injection, import output, parity fixtures.
+4. Run the suites: W `go test -short ./modules/wristband/...`, P `go test ./...` on Docker (testcontainers Postgres), U `go vet` and `go test -short`.
+
+## Gaps fixed during the review
+
+All gaps were missing test pins; the code already implemented each mitigation.
+
+| Commit | Repo | Threats | What the new test pins |
+|--------|------|---------|------------------------|
+| eaa545c | summercms.go | T-19.4-02, T-19.4-09, T-19.4-13 | `TestOIDCCodeBindingSmoke`: a code is refused for another client or redirect URI and burned; authorize refuses `plain` and malformed challenges; verifier rules; 60 s default code TTL. `TestOIDCLogsCarryNoCredentials`: rejected exchanges log client id, IP and reason only, never secret, code or verifier; key parse errors quote no key. `TestOIDCSubjectIsRandomSmoke`: a public sub is a random UUIDv4. |
+| b4223be | sm-oauthserver-plugin | T-19.4-15, T-19.4-23, T-19.4-27, T-19.4-32 | `TestAdminSurfaceHidesCredentials` (no Docker): only the clients and branding controllers, each behind its permission; none edits signing keys; no admin YAML or partial names `secret_hash` or a key column. `TestUserCascadeSmoke` extended: a deactivated user's unexpired session JWT signs nobody in at authorize, and the claims builder reports the user as gone. |
+| f8eaf70 | sm-oauthserver-plugin | T-19.4-20, T-19.4-28 | `TestTokenLimitsSmoke`: the token route never parses a form over `token_body_limit`, the `oauth-token` bucket answers 429 after 20 attempts per client_id, discovery and JWKS are not throttled. `TestImportKeyDirErrorsNameNoKey` (no Docker): a mismatched pair, a missing key_dir and an unreadable key abort before any write, naming kid and file, never quoting key material. |
+
+## Threat register
+
+| Threat | Mitigation as built | Implementation | Test (repo) | Status |
+|--------|---------------------|----------------|-------------|--------|
+| T-19.4-01 | Unknown client, non-OIDC client and redirect mismatch are rendered through the host (400, framing and no-store headers), never redirected. Redirect URIs match byte for byte (constant-time compare); the port may vary only for `is_dev` clients on http `localhost`, `127.0.0.1` or `[::1]` with identical path, query and fragment. | W `oidc_authorize.go:80`, `:84`; W `oidc_redirect.go:92`, `:125`; W `oidc_authorize.go:366` (render headers) | `TestOIDCAuthorizeStartSmoke`, `TestPHPRedirectEncodingSmoke` (loopback table) (summercms.go) | verified |
+| T-19.4-02 | S256 only; challenge `^[A-Za-z0-9_-]{43,128}$`; verifier 43-128 unreserved characters compared in constant time; the code is bound to client and redirect URI, lives 60 s, is consumed by one guarded UPDATE. | W `oidc_authorize.go:133-138`, `:439`; W `oidc_token.go:223-231`, `:489`; W `oidc_options.go:109`; P `classes/oidc_store.go:202` | `TestOIDCCodeBindingSmoke` (new), `TestOIDCReplayRevokesSmoke` (expired code, wrong verifier) (summercms.go) | fixed in commit eaa545c (test pin; code unchanged) |
+| T-19.4-03 | The code is consumed before any other check; a replay of a consumed code revokes the access and refresh tokens issued from it, and the transaction commits although the answer is `invalid_grant`. | W `oidc_token.go:203-221`; P `classes/oidc_store.go:301` (`RevokeAccessTokensForCode`) | `TestOIDCReplayRevokesSmoke` (summercms.go), `TestOIDCFlowSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-04 | One-shot consent token: 32 random bytes, stored as SHA-256(token pipe user id) on the request row, read under `FOR UPDATE`, compared in constant time, cleared on use; the request row has no user column; every failure renders `expired_request`. | W `oidc_consent.go:16`, `:67`, `:135-146`, `:249` | `TestOIDCResumeDecideSwitchSmoke` (token reuse, another user's token) (summercms.go); `TestLoginHandoffAndSwitchSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-05 | MCP flavour refuses kind oidc at authorize and token; OIDC flavour accepts only kind oidc at authorize, resume, decide, token and userinfo; the plugin's stores filter kind in SQL. `openid` stays outside the MCP scope allowlist. | W `authorize.go:64`, `token.go:197`; W `oidc_authorize.go:80`, `:310`; W `oidc_token.go:172`; W `oidc_userinfo.go:47`; P `classes/oidc_store.go:76`, `classes/mcp_store.go:68` | `TestKindIsolationSmoke` (summercms.go); `TestMCPStoreSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-06 | Secret prefix gate, SHA-256 hex compared in constant time, a dummy comparison for unknown clients, one uniform `invalid_client` 401 for unknown, inactive, non-OIDC, unprefixed and wrong secrets; the `oauth-token` bucket throttles per client_id (see T-19.4-36). | W `oidc_token.go:157-188` (dummy compare `:169`); P `buckets.go:44` | `TestOIDCTokenErrorsSmoke` (summercms.go); `TestBucketKeysSmoke`, `TestTokenLimitsSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-07 | `aud` is the client id as a JSON string, `nonce` echoed when sent, `at_hash` over the issued access token, `exp` from `IDTokenTTL`; relying parties verify against the JWKS. | W `oidc_keys.go:232-243` | `TestOIDCTracerSmoke` (summercms.go); `TestRelyingPartyInterop` RS256 and ES256 with go-oidc (sm-oauthserver-plugin) | verified |
+| T-19.4-08 | The server only signs; the JWS method is derived from the key type and a mismatch of `Alg` and key is refused; discovery lists exactly the ring's algorithms; every JWK carries `alg` and `use: sig`. | W `oidc_keys.go:165`, `:256` | `TestMixedKeyRingSmoke` (EC key labelled RS256 refused, HS256 refused, discovery algorithms) (summercms.go) | verified |
+| T-19.4-09 | The only log line of the OIDC flavour carries client_id, client IP and a fixed reason; key material reaches the engine only as `crypto.Signer`; key parsing and signing errors are fixed texts; storage errors become a bare 500. | W `oidc_token.go:508`; W `oidc_keys.go:97-140`, `:249` | `TestOIDCLogsCarryNoCredentials` (new) (summercms.go) | fixed in commit eaa545c (test pin; code unchanged) |
+| T-19.4-10 | Userinfo answers one uniform 401 (empty body, `Bearer error="invalid_token"`, no-store) for missing, malformed, unknown, expired, revoked, wrong-kind, inactive-client and gone-user cases. | W `oidc_userinfo.go:25-73`, `:87` | `TestOIDCUserInfoSmoke`, `TestOIDCReplayRevokesSmoke` (summercms.go) | verified |
+| T-19.4-11 | Identity claims pass the `IdentityClaims` allowlist and never a protocol claim name; protocol claims are written after them and `sub` once more last; userinfo skips protocol names. | W `oidc_keys.go:207`, `:224-243`; W `oidc_userinfo.go:133` | `TestOIDCTracerSmoke` (the fake identity carries `iss` and `x_extra`; the id_token keeps the real `iss` and drops `x_extra`, userinfo carries no `iss`) (summercms.go) | verified |
+| T-19.4-12 | Refresh is off by default (`refresh.enabled: false`); only an `OfflineAccess` client granted `offline_access` receives one; rotation on every use under `FOR UPDATE`; a replayed rotated token revokes the lineage and its access tokens. | W `oidc_token.go:286`, `:303-425`; P `classes/oidc_store.go:426`, `:462`; P `config/config.yaml:45` | `TestOIDCRefreshOptInSmoke` (summercms.go) | verified |
+| T-19.4-13 | `sub` is a random UUIDv4 per (user, sector), inserted once (`ON CONFLICT DO NOTHING` then read back); pairwise clients get per-sector subs. | W `oidc_subject.go:67`; P `classes/oidc_store.go:374` | `TestOIDCSubjectIsRandomSmoke` (new), `TestPairwiseSubjectSmoke` (summercms.go) | fixed in commit eaa545c (test pin; code unchanged) |
+| T-19.4-14 | Flavour dispatch at the top of `Authorize` and `Token`; MCP encoders untouched; OIDC-only handlers 404 on an MCP server. | W `authorize.go:35`, `token.go:67`, `server.go:179` | the full wristband suite incl. phase 08 MCP tests, `TestDefaultOptionsResourceEmpty` (summercms.go); `TestOAuthResourceExplicit` (fonoteka.go, run in plan 01) | verified |
+| T-19.4-15 | Private PEM stored as `lagoon.Encrypted` with `json:"-"`, decrypted only inside the key ring; key reads and writes use a silent GORM logger; key write errors are reduced to the SQLSTATE; never an admin controller, field or column. | P `models/signing_key.go:21`; P `classes/keyring.go:207`, `:242`, `:273`; P `controllers/admin_registry.go:12` | `TestOIDCFlowSmoke` (stored value is ciphertext), `TestKeyRingFirstKeyRaceSmoke` (no key material in output), `TestAdminSurfaceHidesCredentials` (new) (sm-oauthserver-plugin) | verified |
+| T-19.4-16 | Partial unique index `oas_keys_one_active`; first key inserted with `ON CONFLICT (active) WHERE active DO NOTHING`; the loser re-reads the winner. | P `updates/202610190001_create_golem15_oauthserver_tables.go:153`; P `classes/keyring.go:221-237` | `TestKeyRingFirstKeyRaceSmoke` (eight instances, one key) (sm-oauthserver-plugin) | verified |
+| T-19.4-17 | The engine sets `X-Frame-Options: DENY`, `frame-ancestors 'none'`, `no-store, private` and `no-referrer` before the host renders a consent or error page. | W `oidc_authorize.go:366-377` | `assertRendered` in the authorize smokes (summercms.go); `TestConsentPageBrandingSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-18 | `html/template` everywhere (no `template.HTML`/`JS`/`URL` in the plugin); colours, font family, https-only font URL and custom CSS pass the sanitisers before `template.CSS`, and `brandingStyle` re-sanitises; custom CSS capped at 20000 and stripped of tag openers until stable; the danger colour is fixed. The admin form checks hex colours, font family and https font URL on save. Admin partials render through cabana's `html/template`. | P `classes/host.go:8`; P `classes/branding.go:146`, `:191`, `:208`; P `controllers/branding.go` (`checkBranding`) | `TestConsentPageBrandingSmoke` (`<script>` client name, `</style>` and `<<</style>` CSS), `TestBrandingAdminSmoke` (non-hex colour refused) (sm-oauthserver-plugin) | verified |
+| T-19.4-19 | The consent row is selected `FOR UPDATE` by the jwt.auth principal and the path client_id; another user's or an unknown client answers 404 and touches nothing. | P `controllers/authorizations.go:125-148` | `TestAuthorizationsSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-20 | PHP buckets on surf's shared store (authorize 30, token 20, userinfo 60, authorizations 120 a minute); the token route caps its body with the plugin's `oauthserver.body.limit` before the bucket reads the form; discovery and JWKS stay unthrottled and cacheable. | P `buckets.go:44`; P `routes.go:45`; P `middleware.go` (`bodyLimit`) | `TestBucketKeysSmoke`, `TestTokenLimitsSmoke` (new) (sm-oauthserver-plugin) | fixed in commit f8eaf70 (test pin; code unchanged) |
+| T-19.4-21 | The userinfo bucket key is SHA-256 of the bearer, never the bearer. | P `buckets.go:79` | `TestBucketKeysSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-22 | Switch account burns the consent token, blacklists the session JWT's jti until expiry and forgets the cookie with the 19.3 Domain and Path; the parked request carries no user. | W `oidc_consent.go:220-271`; U `classes/session_user.go:89` | `TestLoginHandoffAndSwitchSmoke` (old jti blacklisted, blacklisted session does not resume) (sm-oauthserver-plugin); `TestOIDCResumeDecideSwitchSmoke` (summercms.go) | verified |
+| T-19.4-23 | `user.Deleting` and `user.Deactivating` delete tokens, codes, MCP codes and consents (and subjects on hard delete) inside the user change's transaction; deactivation is a soft delete, and soft-deleted users are not returned by `RequestUser` or `IdentityClaims`. | P `classes/cascade.go:41`; U `classes/session_user.go:34`; P `classes/claims.go:59` | `TestUserCascadeSmoke` (extended: deactivated session at authorize goes to login, claims report the user gone) (sm-oauthserver-plugin) | fixed in commit b4223be (test pin; code unchanged) |
+| T-19.4-24 | MCP routes mount only with `mcp.enabled` (default false); dynamic registration creates kind mcp clients, which the OIDC flow refuses. | P `routes.go:68`; P `config/config.yaml:73`; P `classes/mcp_store.go:101`, `:119` | `TestMCPStoreSmoke` (paths 404 when disabled, MCP client refused by OIDC) (sm-oauthserver-plugin) | verified |
+| T-19.4-25 | Literal OIDC paths; a `/oauth/{provider}` route of another plugin neither shadows nor is shadowed. | P `routes.go:38-66` | `TestRouteGuardSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-26 | sm-user-plugin changes are additive exports and a new event; `DeactivateUsers` signature unchanged; consuming apps pin older commits until they bump. | U commits b82d85f, ee47440, 80b436d | U `go vet` and `go test -short` green in this review; `git diff c077029 -- classes/admin_actions.go` shows no `DeactivateUsers` signature change | verified |
+| T-19.4-27 | The plaintext secret comes from `IssueOIDCClientCredentials`, only the SHA-256 is stored; it is parked in the cache under `oauthserver:reveal:{admin}:{record}` for 5 minutes and forgotten on first read; regenerate replaces the hash in the action's transaction; `secret_hash` is `json:"-"`, never fillable, never a field or column. | P `controllers/clients.go:91-132`, `:150-175`; P `classes/reveal.go:28`, `:57`; P `models/client.go:33` | `TestClientsAdminSmoke` (reveal once, not for another client, no hash in list or form JSON, regenerate invalidates the old secret), `TestAdminSurfaceHidesCredentials` (new) (sm-oauthserver-plugin) | verified |
+| T-19.4-28 | Key PEMs read from the operator's directory, public half checked against the `.pub`, private PEM written only through `lagoon.NewEncrypted` with a silent logger; output names kid and state only; errors name kid and file, never content; a write failure never surfaces the driver message. | P `console/import_keys.go:161`, `:200`, `:246`, `:259`, `:268` | `TestImportWinterCutoverSmoke` (output carries no secret, hash, code, token or PEM), `TestImportKeyDirErrorsNameNoKey` (new) (sm-oauthserver-plugin) | fixed in commit f8eaf70 (test pin; code unchanged) |
+| T-19.4-29 | Refuses non-empty target tables without `--force`, `--dry-run` reports without writing, one transaction, aborts naming the count when a referenced user is missing; decode errors name the column, never the value; insert errors keep only the SQLSTATE. | P `console/import_winter.go:212`, `:232`, `:291`, `:434` | `TestImportWinterCutoverSmoke` (missing user, dry run, second import refused and unchanged) (sm-oauthserver-plugin) | verified |
+| T-19.4-30 | A retired key stays in the JWKS for `rotation_grace_hours` (24 by default) and prune removes it only after; scheduled rotation is off unless `rotation_interval` is set; the README forbids rotating within an hour of the cutover. | P `classes/keyring.go:111`, `:166`; P `schedule.go:14-16`; P `README.md:160` | `TestRotateAndPruneSmoke`, `TestScheduleSmoke` (sm-oauthserver-plugin) | verified |
+| T-19.4-31 | `TestParityFixturesHoldNoSecrets` and the Task 6 grep refuse secret, token and key shapes under testdata; the vars file lives outside the repositories with mode 0600 (runbook); no recordings were made in this phase (skip-parity), so no parity client exists in WavePath to delete. | P `parity_test.go:474`; P `testdata/parity/README.md` | `TestParityFixturesHoldNoSecrets` (sm-oauthserver-plugin); Task 6 skip-branch verify (no `response:` in any flow, no secret pattern, no `.vars` tracked) | verified |
+| T-19.4-32 | `manage_clients` and `manage_settings` on the controllers and on the Settings link; the Clients queries are scoped to kind oidc; the signing-key model has no controller. | P `controllers/clients.go:65`, `:72`, `:77`; P `controllers/branding.go:60`; P `admin.go:44`; P `controllers/admin_registry.go:12` | `TestClientsAdminSmoke` (403 without `manage_clients`), `TestAdminSurfaceHidesCredentials` (new) (sm-oauthserver-plugin) | fixed in commit b4223be (test pin; code unchanged) |
+| T-19.4-33 | conga runs scheduled commands as River periodic jobs, which only the elected leader enqueues; prune is idempotent and a duplicate rotation would only add one retired key. | `summercms.go/modules/conga/scheduler.go:130`; P `schedule.go` | `TestScheduleSmoke` (sm-oauthserver-plugin) | accepted (low; leader-elected scheduler, idempotent jobs) |
+| T-19.4-34 | `lagoon.Encrypted` decrypts with `app.previous_keys`; the README requires keeping the previous key when rotating `app.key`. | P `README.md:162`, `:166` | none needed (documentation control) | accepted (low; operator procedure documented) |
+| T-19.4-SC | Plan 01 installed no module; plan 02 added go-oidc v3.21.0 and x/oauth2 v0.37.0 test-only after the blocking human package check ("approved"); plan 03 installed no module (gocloud.dev v0.46.0 and goccy/go-yaml v1.19.2 moved from indirect to direct at the same versions); the framework `go.mod` and `go.sum` are unchanged across the phase. | P `go.mod`; `summercms.go/go.mod` | `git diff 95051d2..HEAD -- go.mod go.sum` in summercms.go is empty; `git diff f1cc3b9..HEAD -- go.mod` in the plugin shows only the two indirect-to-direct moves | verified |
+
+## New findings
+
+| Threat | Category | Component | Severity | Finding | Status |
+|--------|----------|-----------|----------|---------|--------|
+| T-19.4-36 | Denial of service / Spoofing | `oauth-token` bucket key | low | The bucket keys by the `client_id` form field, else the IP (PHP behaviour). A caller authenticating with Basic credentials can put any `client_id` in the form and land in a fresh bucket on every request, so the per-client throttle does not bound guesses against one client's secret. | accepted (D-18 keeps the PHP keys; secrets, codes and access tokens carry 256 random bits, codes live 60 s and need the PKCE verifier, so online guessing is not feasible; revisit if the bucket keys are ever changed) |
+| T-19.4-37 | Information disclosure | branding custom CSS and font stylesheet | low | An administrator with `manage_settings` can write CSS (or point the https font stylesheet at a host they control) that reads page content through attribute selectors and background-image requests, for example the hidden `consent_token` value. The sanitisers stop markup injection, not CSS-based exfiltration. | accepted (the branding administrator is trusted, as in PHP; the consent token alone is useless without the victim's session and is bound to the user; a stricter CSP `style-src` would break the PHP-compatible custom CSS and font URL features) |
+| T-19.4-38 | Spoofing | authorization response | low | Code and error redirects carry no `iss` parameter (RFC 9207 mix-up defence). | accepted (D-14 PHP parity: relying parties must not notice the switch; clients are administrator-registered first-party apps with exact redirect URIs, so an IdP mix-up needs a second, malicious IdP the relying party trusts) |
+| T-19.4-39 | Denial of service | `/oauth/mcp/authorize` | low | With `mcp.enabled` the MCP authorize route has no throttle bucket (registration and token do). | accepted (MCP routes are off by default; the MCP authorize endpoint only parks a request and renders consent, as in phase 08's flavour; add a bucket when an application turns the switch on) |
+
+## Cross-cutting checks
+
+**Logs and errors (ASVS V7).** wristband's OIDC files log exactly one line (`oidc_token.go:512`: client_id, IP, fixed reason); `TestOIDCLogsCarryNoCredentials` pins it. Plugin `slog` calls (`classes/branding.go:94`, `:236`, `classes/claims.go:130`, `:188`, `classes/host.go:296`, `:338`) log database and template errors only, never request input. Every `fmt.Errorf` in `classes/keyring.go` wraps a fixed wristband text or a SQLSTATE. Console commands print counts, kids and file names only (`console/prune.go`, `console/rotate_keys.go` fixed failure lines, `console/import_*.go`). GORM's default logger could print statement arguments on slow or failing statements; in the token, code and consent paths those arguments are SHA-256 digests, never raw values, and every key write runs with the silent logger.
+
+**no-store on credential-carrying responses (V8).** Token answers and errors: `oidcNoStore()` (`no-store, private` plus `Pragma: no-cache`, W `oidc_token.go:51`). Userinfo success and 401: W `oidc_userinfo.go:82`, `:90`. Consent and error pages (which carry the consent token): W `oidc_authorize.go:366`. Code and error redirects: `redirectNoStore` (W `oidc_authorize.go:380`). Consent JSON and authorized-apps JSON: P `controllers/consent_api.go:123` (`writeJSON` sets `no-store, private`). Discovery and JWKS stay cacheable on purpose.
+
+**Consent replay.** The decide POST reads the request `FOR UPDATE`, burns the token digest, and consumes the request with a guarded UPDATE; a second POST of the same form renders `expired_request` (`TestOIDCResumeDecideSwitchSmoke`). The consent JSON decide shares `decideConsent`.
+
+**Kind isolation.** See T-19.4-05: authorize, resume, decide, token and userinfo refuse mcp-kind clients; the stores filter kind in SQL.
+
+**cabana surface.** See T-19.4-15, T-19.4-27, T-19.4-32: no `secret_hash`, no signing-key model, no key column in any admin YAML or partial; `TestAdminSurfaceHidesCredentials` runs without Docker.
+
+**Branding.** See T-19.4-18 and T-19.4-37.
+
+**Import output.** See T-19.4-28 and T-19.4-29.
+
+**Parity fixtures.** See T-19.4-31. The user replied "skip-parity" at Task 5, so no PHP recording exists; the flows hold requests only.
+
+## ASVS L1 walk
+
+| Category | Result |
+|----------|--------|
+| V2 Authentication | Client secrets: 256-bit random, SHA-256 at rest, constant-time compare, dummy compare for unknown clients, uniform `invalid_client` (T-19.4-06). End-user authentication stays with sm-user-plugin; the provider reads the session JWT with the same checks as the jwt guard (signature, blacklist, `tokens_valid_after`, soft delete). |
+| V3 Session management | Switch account blacklists the jti and forgets the cookie (T-19.4-22); authorize requests are parked without a user and bound to the consenting user by the token digest (T-19.4-04). |
+| V4 Access control | Kind isolation (T-19.4-05), authorized-apps scoped to the JWT principal (T-19.4-19), admin permissions and kind-scoped admin queries (T-19.4-32), reveal store scoped per administrator and record (T-19.4-27). |
+| V5 Input validation | Allowlists for response_type, PKCE method, scopes; regexes for challenge and verifier; 255-character caps on state, nonce and scope; exact redirect matching; last-value semantics for repeated parameters; redirect URIs checked on admin save (`normalizeClient`, plan 03 deviation); branding formats checked on save and sanitised on render. |
+| V6 Cryptography | golang-jwt RS256 and ES256 with the method derived from the key type (T-19.4-08); RSA 2048 and P-256 keys from `crypto/rand`; imported RSA keys under 2048 bits refused; private keys AES-256-GCM via `lagoon.Encrypted` (T-19.4-15). |
+| V7 Errors and logging | See the cross-cutting check above (T-19.4-09). |
+| V8 Data protection | no-store everywhere credentials travel; claims allowlist (T-19.4-11); random subjects (T-19.4-13); bucket keys never hold a bearer (T-19.4-21); grants removed with the user (T-19.4-23). |
+| V13 API | RFC 6749/6750 error shapes and statuses as PHP; uniform userinfo 401 (T-19.4-10); body cap and throttles (T-19.4-20). |
+| V14 Configuration | Framing and referrer headers on rendered pages (T-19.4-17); refresh, MCP routes and scheduled rotation off by default; invalid `key_algorithm`, `consent_mode` or `rotation_interval` fail boot. |
+
+## Suites run for this review
+
+- summercms.go: `go vet ./...`; `go test -count=1 -short ./modules/wristband/...` green (includes the three new tests).
+- sm-oauthserver-plugin: `go vet ./...`; `go test -count=1 ./...` on Docker (testcontainers Postgres): 19 tests pass, `TestPHPParityReplay` and `TestIDTokenShapeParity` skip with "no PHP recordings" (they fail under `PHASE194_REQUIRE_PARITY=1`, checked).
+- sm-user-plugin: `go -C ../fonoteka.go vet ./plugins/golem15/user/...` and `go test -count=1 -short ./plugins/golem15/user/...` green.
+- The OpenID Foundation conformance suite (RESEARCH A11, optional) was not run.