3 Commits

Author	SHA1	Message	Date
Jakub Zych	c14238b94b	feat(bouncer): stamp auth_time at sign-in and carry it unchanged through refresh (C-CR-02) ... - MintAudience stamps auth_time equal to iat; refreshAudience copies the presented token's value and never renews it (absent stays absent) - bouncer.ClaimAuthTime and bouncer.VerifyAuthTime for plugins, with the same signature, audience and expiry checks as VerifyClaims - TestAuthTimeSmoke traces mint, refresh and read	2026-10-23 16:13:49 +02:00
Jakub Zych	5382947ef8	fix(11-06): send Cache-Control: no-cache, private on the jwt.auth 401 ... The recorded PHP 401 for a missing bearer (realtime token no-bearer case) carries Laravel's default Cache-Control header; the Go guard's 401 omitted it, so the replay failed on header.Cache-Control.	2026-09-30 13:31:55 +02:00
Jakub Zych	5e50b166ef	refactor(10.2-01): nest framework packages under modules ... - Move remaining beach packages and embedded admin assets\n- Rewrite framework, example, build, and gate paths	2026-09-28 02:21:02 +02:00