coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record live confirmation of both key-cape login fixes (INFD-IN-0005)

Browse source 
Platform-root confirmed a live approval of infd-20260927-b01 succeeded
after the discovery-header fix (key-cape@8be8065) was deployed
alongside the freshness fix (911e9de). Both defects this intake
predicted/tracked are resolved and verified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 169987@bnt-lap001
Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999
This commit is contained in:
tegwick 2026-09-27 20:25:05 +02:00
parent 237132bb15
commit 895de67a2d
1 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

21
intakes/intakes.md
View file

@ -312,10 +312,23 @@ description: >-
(`ADHOC-2026-09-27`, commit 911e9de): completeAuthorization was reusing an
existing kc_login cookie's IssuedAt even on the two call sites that had
just validated an MFA token in that same request, backdating freshness.
Regression test added; full key-cape suite green. The prompt=login/max_age
and actionable-freshness-error parts of this intake remain open — do not
close until platform-root confirms a live approval succeeds against the
fixed key-cape build.
Regression test added; full key-cape suite green.
Same rollout also surfaced a second, independent bug in the same code path:
the Authelia discovery/JWKS fetch used to verify upstream ID tokens never
carried the split-horizon X-Forwarded-Proto/Host headers that the token
exchange got in key-cape@3b0446e, so Authelia 4.38 failed closed on it and
no KeyCape login worked at all (not just informed-decision's). Fixed in
key-cape@8be8065 with its own regression test
(`TestDiscoveryFetch_CarriesPublicOriginHeaders`), deployed to `sso`.
2026-09-27 (later): platform-root confirmed a live approval of
infd-20260927-b01 succeeded in the browser after both key-cape fixes were
deployed. The freshness-backdating and discovery-header defects this intake
tracked are resolved and verified live. The prompt=login/max_age and
actionable-freshness-error parts of the original ask remain open — keep
this intake open for those, or split them into a fresh intake and close
this one; operator's call.
state_hub_intake_id: "01a0c14e-f965-788f-8efb-4424f1f1ad08"
```