glass beadian
74f0802f1a
From the logic audit: - consent rejects sid-less bearers and requires a LIVE hub session (sessionAlive) before minting codes — a logged-out bearer can no longer mint downstream tokens inside its TTL - refresh rotation race closed: consume returns whether THIS call won; the loser revokes the family (reuse detection now holds under concurrency) - error redirects carry iss (RFC 9207) on error responses too - logout awaits the revocation and no longer returns ok for missing or forged bearers |
||
|---|---|---|
| .. | ||
| migrations | ||
| src | ||
| package.json | ||
| tsconfig.json | ||
| vitest.config.ts | ||