xarmian 7b95dae4f5 fix(oauth): another client's replay of a spent refresh token or code revokes nothing (BUG-3400) (#1807) ...

* fix(oauth): another client's replay of a spent refresh token or code revokes nothing (BUG-3400)

Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS

* fix(oauth): pin the confidential-client case and document BUG-3400's residuals

Claude-Session: https://claude.ai/code/session_01Q9WssCjFuHjSfLABoW4tmS

2026-10-05 13:22:23 -04:00

..

audience.go

feat(oauth): a second canonical resource, with every token bound to one (TASK-3321 U2a) (#1715)

2026-10-02 02:06:09 -04:00

main_test.go

perf(test): wire remaining store helpers onto storetest fixture (TASK-1915) (#789)

2026-07-03 12:17:03 -04:00

server_test.go

fix(auth): disabling an account ends every credential, and a disabled account gets no new one (BUG-3349) (#1741)

2026-10-02 18:34:56 -04:00

server.go

feat(oauth): delegated sign-in for installed apps through the issuance barrier, shipped closed (TASK-3399, SPEC-6 U5b-1) (#1779)

2026-10-04 19:22:21 -04:00

session_test.go

feat(oauth): live workspace allow-list + role enforcement (TASK-953) (#377)

2026-05-02 14:29:17 -04:00

session.go

feat(oauth): live workspace allow-list + role enforcement (TASK-953) (#377)

2026-05-02 14:29:17 -04:00

storage.go

fix(oauth): another client's replay of a spent refresh token or code revokes nothing (BUG-3400) (#1807)

2026-10-05 13:22:23 -04:00