glass beadian 74f0802f1a fix: oidc hardening — sid-less consent refused, rotation race closed, iss on errors, logout honesty ... From the logic audit: - consent rejects sid-less bearers and requires a LIVE hub session (sessionAlive) before minting codes — a logged-out bearer can no longer mint downstream tokens inside its TTL - refresh rotation race closed: consume returns whether THIS call won; the loser revokes the family (reuse detection now holds under concurrency) - error redirects carry iss (RFC 9207) on error responses too - logout awaits the revocation and no longer returns ok for missing or forged bearers		2026-10-18 11:54:59 +00:00
..
oidc.config.ts	fix: oidc hardening — sid-less consent refused, rotation race closed, iss on errors, logout honesty	2026-10-18 11:54:59 +00:00
oidc.controller.ts	feat: OIDC phase 2 — session-bound refresh tokens, server-side logout	2026-10-14 11:33:47 +00:00
oidc.keys.ts	publishing: unfenced vault accessor for the amplify path	2026-10-13 18:32:38 +00:00
oidc.module.ts	publishing: unfenced vault accessor for the amplify path	2026-10-13 18:32:38 +00:00
oidc.refresh-store.ts	fix: logic-audit P0/P1 wave — CORS PUT, chunked cap, presign checksums, logout await, refresh rotation race	2026-10-18 10:18:02 +00:00
oidc.service.ts	fix: oidc hardening — sid-less consent refused, rotation race closed, iss on errors, logout honesty	2026-10-18 11:54:59 +00:00
oidc.test.ts	fix: oidc hardening — sid-less consent refused, rotation race closed, iss on errors, logout honesty	2026-10-18 11:54:59 +00:00