shankar0123 11b145b641 Merge Fix 06 (HIGH A-6): strict UA/IP binding — close request-empty bypass in MED-16 ...

# Conflicts:
#	CHANGELOG.md
#	internal/api/handler/auth_session_oidc.go
#	internal/api/handler/auth_session_oidc_test.go

2026-05-11 11:19:04 +00:00

..

api

Merge Fix 06 (HIGH A-6): strict UA/IP binding — close request-empty bypass in MED-16

2026-05-11 11:19:04 +00:00

auth

Merge Fix 06 (HIGH A-6): strict UA/IP binding — close request-empty bypass in MED-16

2026-05-11 11:19:04 +00:00

cli

auth-bundle-1 Phase 8 follow-up: classify issuer/target audit rows + auditor end-to-end tests + gofmt drift

2026-05-09 20:23:41 +00:00

cms

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

config

harden(oidc): pre-login UA/IP binding (MED-16) — RFC 9700 §4.7.1

2026-05-10 23:18:23 +00:00

connector

2026-05-05 18:18:29 +00:00

crypto

security(signer): bound FileDriver paths with SafeRoot + reject .. (CodeQL #27, CWE-22)

2026-05-04 05:04:35 +00:00

deploy

2026-05-05 18:18:29 +00:00

domain

feat(auth/rbac): scope_type+scope_id+expires_at on role grants (HIGH-10)

2026-05-10 22:47:45 +00:00

integration

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

mcp

fix(auth/rbac): scope-aware ActorRole revoke (A-4)

2026-05-11 10:50:34 +00:00

pkcs7

2026-05-05 18:18:29 +00:00

ratelimit

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

repository

Merge Fix 04 (HIGH A-4): scope-aware ActorRole revoke

2026-05-11 11:16:24 +00:00

scep/intune

security(scep-intune): annotate verifyES256/RS256 SHA-256 as RFC-mandated (CodeQL #21 false positive)

2026-05-04 05:08:02 +00:00

scheduler

fix(oidc/bcl): jti replay-cache + iat freshness check (HIGH-3 closure)

2026-05-10 20:53:29 +00:00

secret

secret: migrate EJBCA / GlobalSign / Sectigo credentials to *secret.Ref (Phase 2)

2026-05-02 12:53:58 +00:00

service

fix(auth/rbac): scope-aware ActorRole revoke (A-4)

2026-05-11 10:50:34 +00:00

tlsprobe

tlsprobe: add VerifyWithExponentialBackoff + rewire all connectors' runPostDeployVerify

2026-05-02 22:56:07 +00:00

trustanchor

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

validation

ci: convert literal Unicode in headers_test.go to \u escapes (ST1018)

2026-05-04 05:00:14 +00:00