3 Commits

Author	SHA1	Message	Date
Jakub Zych	e25e73378c	feat(19.4-01): OIDC token, keys, subjects and opt-in refresh ... - ES256 keys, PKCS#1/SEC1 parsing fallbacks, EC JWKs, mixed RS256/ES256 rings - Pairwise subjects per sector (SubjectSector, ErrSectorRequired) - Opt-in refresh_token grant (OIDCOptions.RefreshEnabled): OfflineAccess clients only, rotation, lineage revocation on replay, fresh id_token without nonce - IssueOIDCClientCredentials with the PHP oas_/oas_cs_ shapes - Smoke tests: token errors, replay revocation, userinfo 401s, mixed key ring, pairwise subjects, refresh opt-in	2026-10-19 18:24:45 +02:00
Jakub Zych	dfa3c3e8b4	feat(19.4-01): OIDC authorize, consent and switch account match the PHP provider ... - Full validation chain with PHP order and messages; repeated params last-wins - is_dev loopback port matching (matchOIDCRedirectURI); PHP http_build_query redirects, no iss - One-shot consent token burned under row lock; deny; SwitchAccount; JSON-mode ConsentRequest and DecideConsent - ClientRecord.Kind with ClientKindMCP/ClientKindOIDC; each flavour refuses the other kind at authorize, token and userinfo (D-08) - Smoke tests: start, resume/decide/switch, kind isolation, PHP encoding	2026-10-19 18:21:11 +02:00
Jakub Zych	659b42aaa8	feat(19.4-01): OIDC flavour of wristband with an end-to-end tracer ... - NewOIDCServer/SetOIDCBackend build a second Server on the same engine; Authorize and Token dispatch by flavour, Metadata/Register 404 on OIDC - OIDCBackend/OIDCTx, KeyStore and OIDCHost seams; MCP Backend untouched - Discovery (PHP field order), JWKS (stdlib JWK encoding), authorize with resume and one-shot consent token, token with an RS256 id_token signed through golang-jwt map claims, userinfo - TestOIDCTracerSmoke verifies the id_token against the served JWKS	2026-10-19 18:18:05 +02:00