Lucas Berger 2691dd0f95 fix(19): IN-04 enforce single-use OIDC-link nonce to prevent state replay

2026-06-17 20:37:09 -04:00

..

devBypass.ts

fix(19): BL-04 keep context oidcIss/oidcSub null for local users (no fabricated identity sentinels)

2026-06-17 20:24:01 -04:00

linkNonceStore.ts

fix(19): IN-04 enforce single-use OIDC-link nonce to prevent state replay

2026-06-17 20:37:09 -04:00

linkOidc.ts

feat(19-02): linkOidcToUser helper + POST /api/me/link-oidc initiation

2026-06-17 16:38:14 -04:00

localAuthMiddleware.ts

fix(19): BL-04 keep context oidcIss/oidcSub null for local users (no fabricated identity sentinels)

2026-06-17 20:24:01 -04:00

localCredentials.ts

fix(19): WR-03 make scrypt hashing async (threadpool) to avoid event-loop starvation DoS

2026-06-17 20:30:28 -04:00

localSession.ts

fix(19): IN-01 validate LOCAL_SESSION_EXPIRES coercion (fallback on NaN/non-positive)

2026-06-17 20:34:14 -04:00

middleware.ts

feat(19-03): wire /callback link branch, OIDC-guard skip, de-Authelia comments

2026-06-17 16:59:06 -04:00

oidcConfig.ts

fix(19): WR-02+WR-04 centralize OIDC config (env-or-app_config) and discover auth endpoint

2026-06-17 20:26:47 -04:00

persistSessionCookie.ts

style(13-03): apply Prettier formatting across repo

2026-06-11 20:35:18 -04:00

user.ts

fix(12): WR-01 narrow TOCTOU guard and set claimed=true for OIDC inserts

2026-06-15 16:46:41 -04:00