coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement scoped P06 authentication policy and guarded optional onboarding
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m22s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:00:05 +02:00
parent aa709fb854
commit e0b3c25f06
12 changed files with 1085 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/internal/server/oidc/authorize.go
View file

@ -66,6 +66,7 @@ func (p *pendingStateStore) Delete(state string) {
// AuthorizeHandler implements GET /authorize and GET /authorize/callback.
type AuthorizeHandler struct {
EffectivePolicy func(*domain.Client) (*domain.Client, error)
AccountPortalURL string
ClientConfig map[string]*domain.Client
Auth domain.AuthProvider
@ -372,6 +373,13 @@ func (h *AuthorizeHandler) ServeHTTPCallback(w http.ResponseWriter, r *http.Requ
func (h *AuthorizeHandler) decideAssurance(ctx context.Context, ps *PendingState, username string, login *LoginSession) (domain.AssuranceDecision, error) {
client := h.ClientConfig[ps.ClientID]
if h.EffectivePolicy != nil {
var err error
client, err = h.EffectivePolicy(client)
if err != nil {
return domain.AssuranceDecision{}, err
}
}
providerRequired := false
if !domain.ACRRequiresAAL2(ps.ACRValues) && (client == nil || client.MFARequired == nil) {
var err error