coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document the authorization-code bindings for relying parties

Browse source 
KEY-WP-0016 changed /token and /userinfo behaviour with no consumer-facing note;
nothing in docs/ mentioned redirect_uri, so the change would have reached a
deployment silently.

States what an exchange must now send, who is affected and how to roll out.
Every browser registration in dev-config is public with an authorization_code
grant, so only the redirect_uri requirement can affect them; the realistic
failure is a client that sends it to /authorize and omits it at /token, which
has not been observed against a live consumer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
This commit is contained in:
tegwick 2026-09-07 00:17:56 +02:00
parent 2e78648fb2
commit 0d7e2f6b41
3 changed files with 83 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

34
workplans/ADHOC-2026-09-07.md Normal file
View file

@ -0,0 +1,34 @@
---
id: ADHOC-2026-09-07
type: workplan
title: "Document the KEY-WP-0016 authorization-code bindings for consumers"
domain: infotech
repo: key-cape
status: finished
owner: claude
created: "2026-09-07"
updated: "2026-09-07"
---
## Publish the consumer-facing rollout note
```task
id: ADHOC-2026-09-07-T01
status: done
priority: medium
```
KEY-WP-0016 changed `/token` and `/userinfo` behaviour without a consumer-facing
note; no document in `docs/` mentioned `redirect_uri` at all, so the change would
have reached a deployment silently.
Published `docs/authorization-code-bindings.md` stating what an exchange must
send, who is affected and how to roll out. Verified the blast radius rather than
assuming it: all five browser registrations in `config/dev-config.yaml`
(`openbao-admin`, `demo-app`, `netkingdom-bootstrap-console`,
`user-engine-portal`, `coulomb-social`) are `clientType: public` with
`grantTypes: ["authorization_code"]`, so the grant-type and confidential-client
bindings cannot affect them and only the `redirect_uri` requirement can. Named
the realistic failure — a client that sends `redirect_uri` to `/authorize` but
omits it at `/token` — and said plainly that it has not been observed against a
live consumer. Referenced the note from SCOPE.md.