jubnl 20bf9c2312 security: close SEC-H4/H6 gaps from second-pass review ...

- SEC-H6: remove conditional audience check in mcp/index.ts — audience is
  now always enforced against the mcpResource URL. Add migration to revoke
  pre-existing oauth_tokens with audience=NULL so dead rows don't linger.
- SEC-H4: validate doc.issuer against config.issuer inside discover() to
  prevent a MITM'd discovery doc from supplying a crafted expected issuer.
  verifyIdToken caller now passes config.issuer as ground truth, not
  doc.issuer.
- tests: cover three new OIDC callback failure paths (no_id_token,
  id_token_invalid, subject_mismatch) and two idempotency caps (key length
  >128 chars returns 400, body >256 KiB skips caching).

2026-04-20 21:35:30 +02:00

..

mcp

fix(mcp): add RFC 9728 PRM, RFC 8707 audience binding, and collab sub-feature gating

2026-04-20 07:34:38 +02:00

middleware

security: close SEC-H4/H6 gaps from second-pass review

2026-04-20 21:35:30 +02:00

services

test(notifications): bump event_types count to 9 after adding todo_due

2026-04-20 17:38:25 +02:00

systemNotices

feat(system-notices): replace expiresAt with [minVersion, maxVersion) version gate

2026-04-17 20:03:23 +02:00

utils

test: expand test suite to 87.3% backend coverage

2026-04-06 20:08:30 +02:00

scheduler.test.ts

Add comprehensive backend test suite (#339)

2026-04-03 13:17:53 +02:00