@zuplo/lint-win32-x64 7.7.16 → 7.8.0

package/bin/schemas/policy-options.schema.json

@@ -3662,7 +3662,7 @@
                         },
                         "clientSecret": {
                           "type": "string",
-                          "examples": ["$env(MCP_AUTH0_CLIENT_SECRET)"],
+                          "examples": ["$env(AUTH0_CLIENT_SECRET)"],
                           "description": "The Auth0 client_secret. Use $env(...) to source from a secret environment variable."
                         },
                         "scope": {
@@ -5047,7 +5047,7 @@
                               "examples": [
                                 "https://my-tenant.us.auth0.com/authorize"
                               ],
-                              "description": "The IdP /authorize endpoint to redirect the user to. For local development on loopback, use http://127.0.0.1:9000/oauth/dev-login."
+                              "description": "The IdP /authorize endpoint to redirect the user to. For local development on loopback, use http://127.0.0.1:9000/__zuplo/oauth/dev-login (the gateway's default basePath is /__zuplo; adjust if the plugin is configured with a different one)."
                             },
                             "tokenUrl": {
                               "type": "string",
@@ -5805,6 +5805,12 @@
                             {
                               "required": ["prompt"]
                             },
+                            {
+                              "required": ["skipIssuerMetadataValidation"]
+                            },
+                            {
+                              "required": ["skipResourceIndicatorValidation"]
+                            },
                             {
                               "required": ["clientRegistration"]
                             }
@@ -5874,6 +5880,16 @@
                             }
                           ]
                         },
+                        "skipIssuerMetadataValidation": {
+                          "type": "boolean",
+                          "x-advanced": true,
+                          "description": "Allows the authorization server metadata's `issuer` to differ from the server URL used for discovery. Defaults to `false`. Enable only for a confirmed provider metadata mismatch after verifying that its metadata and OAuth endpoints are trusted. This disables the RFC 8414 section 3.3 issuer check; authorization-response and callback checks still apply. Available only with `user-oauth` and `shared-oauth`."
+                        },
+                        "skipResourceIndicatorValidation": {
+                          "type": "boolean",
+                          "x-advanced": true,
+                          "description": "Allows the upstream metadata's `resource` URL to have a different origin or path from the configured upstream URL. Defaults to `false`. The gateway still sends the advertised `resource` on OAuth requests. Enable only for a confirmed provider metadata mismatch: a token intended for another service could otherwise be sent to this upstream. Available only with `user-oauth` and `shared-oauth`."
+                        },
                         "clientRegistration": {
                           "x-advanced": true,
                           "description": "OAuth client registration mode. Defaults to `auto`, which uses Client ID Metadata Documents when the upstream advertises support and falls back to Dynamic Client Registration otherwise.",

package/bin/version.txt

@@ -1 +1 @@
-7.7.16
+7.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/lint-win32-x64",
-  "version": "7.7.16",
+  "version": "7.8.0",
   "description": "The win32-x64 binary for zuplo-lint, the Zuplo API linter.",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",