summercms

Files

Jakub Zych 4bd3b3db4f feat(08-04): implement atomic PKCE-bound code exchange in wristband

- Server.Token: JSON rejection before ParseForm, body-over-query precedence,
  Basic-over-form client auth, exact invalid_request/unsupported_grant_type/
  invalid_client/invalid_grant bodies, Cache-Control/Pragma on success only
- authenticateClient: public/confidential dispatch, constant-time secret
  compare (T-08-SECRET-TIMING)
- exchangeAuthorizationCode: single WithinTx lock/consume/mint/refresh-create
  covering code/client/redirect/resource/PKCE binding and single-use replay
  (T-08-CODE-REPLAY), sequential and concurrent proofs
- rotateRefreshToken: grant_type=refresh_token dispatches per PHP validity
  but is a deliberate invalid_grant placeholder; full rotation is 08-06
- full token_test.go behavior matrix appended alongside the RED anchor

2026-09-23 20:28:07 +02:00

authorize_test.go

feat(08-03): implement exact authorize validation and pending creation in wristband

2026-09-23 20:08:37 +02:00

authorize.go

feat(08-03): implement exact authorize validation and pending creation in wristband

2026-09-23 20:08:37 +02:00

crypto.go

test(08-02): add failing RFC 7591 registration RED test in wristband

2026-09-23 19:37:03 +02:00

feat(08-02): implement exact RFC 7591 registration in wristband

2026-09-23 19:37:54 +02:00