coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish KEY-WP-0008: registration handoff and client MFA isolation
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 34s
Details

Browse source 
Add signed registration/enrollment handoffs, per-request assurance
policy with login-session isolation, and /logout. coulomb-social
stays AAL1 unless acr_values or another client raises the bar.
This commit is contained in:
tegwick 2026-08-16 01:05:27 +02:00
parent fff9e39478
commit b6af6c5268
22 changed files with 1636 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/internal/server/oidc/authorize_test.go
View file

@ -44,6 +44,8 @@ func (m *mockAuthProvider) HandleCallback(_ context.Context, _ domain.CallbackPa
type mockMFAProvider struct {
required bool
requiredErr error
enrolled bool
enrolledErr error
validateErr error
validateCalls int
@ -55,6 +57,10 @@ func (m *mockMFAProvider) CheckMFARequired(_ context.Context, _ string) (bool, e
return m.required, m.requiredErr
}
func (m *mockMFAProvider) HasEnrolledFactor(_ context.Context, _ string) (bool, error) {
return m.enrolled, m.enrolledErr
}
func (m *mockMFAProvider) ValidateMFAToken(_ context.Context, user, token string) error {
m.validateCalls++
m.validatedUser = user