@happyvertical/smrt-users 0.40.48 → 0.40.50
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +4 -0
- package/README.md +8 -0
- package/dist/chunks/{TerminalAuthService-B38D8K_b.js → TerminalAuthService-ZEyW4H1S.js} +15 -9
- package/dist/chunks/TerminalAuthService-ZEyW4H1S.js.map +1 -0
- package/dist/index.js +3 -3
- package/dist/manifest.json +2 -2
- package/dist/services/OidcLoginService.d.ts +2 -0
- package/dist/services/OidcLoginService.d.ts.map +1 -1
- package/dist/services/TerminalAuthService.d.ts +2 -0
- package/dist/services/TerminalAuthService.d.ts.map +1 -1
- package/dist/smrt-knowledge.json +6 -6
- package/dist/sveltekit.js +1 -1
- package/package.json +9 -9
- package/dist/chunks/TerminalAuthService-B38D8K_b.js.map +0 -1
package/AGENTS.md
CHANGED
|
@@ -240,6 +240,10 @@ the package root).
|
|
|
240
240
|
refuses to provision a user when the IdP explicitly returns
|
|
241
241
|
`email_verified: false` (opt out with `{ allowUnverifiedEmail: true }`). An
|
|
242
242
|
absent claim makes no assertion and is not enforced.
|
|
243
|
+
- **RFC 9207 response issuer is exact.** OIDC callbacks validate a supplied
|
|
244
|
+
`iss` against discovered metadata with exact string comparison before trusting
|
|
245
|
+
a code or error. If metadata advertises issuer-response support, `iss` is
|
|
246
|
+
required.
|
|
243
247
|
- **Verified-email Profile reuse is fail-closed.** The typed canonical scenarios
|
|
244
248
|
live in
|
|
245
249
|
`packages/profiles/src/testing/oidcProvisioningDecisionMatrix.ts`; both
|
package/README.md
CHANGED
|
@@ -374,6 +374,14 @@ can pass `transactionCookieSecret` to the route helpers. On success it creates
|
|
|
374
374
|
or reuses a s-m-r-t `Profile`, links an `OidcIdentity`, creates or reuses a `User`,
|
|
375
375
|
records `lastLoginAt`, and sets the standard s-m-r-t session cookie.
|
|
376
376
|
|
|
377
|
+
RFC 9207 authorization-response issuer validation uses exact string comparison
|
|
378
|
+
against the discovered issuer before an authorization code or provider error is
|
|
379
|
+
trusted. When discovery advertises
|
|
380
|
+
`authorization_response_iss_parameter_supported: true`, a missing `iss` is also
|
|
381
|
+
rejected. Remote MCP deployments must require their external authorization
|
|
382
|
+
server to advertise and emit `iss`; see the
|
|
383
|
+
[remote MCP authorization guide](../../docs/content/architecture/remote-mcp-authorization.md).
|
|
384
|
+
|
|
377
385
|
The typed [OIDC provisioning decision matrix](../profiles/src/testing/oidcProvisioningDecisionMatrix.ts)
|
|
378
386
|
is the canonical behavior contract shared with Profiles. Its executable rows
|
|
379
387
|
declare exact reuse and new-identity outcomes, resolver invocation and
|