Build and Publish Container Image / build-and-push (push) Successful in 37s

Details

Harden the authorization-code grant and UserInfo verification

Closes the local protocol surface of gap G01 from the scope assessment
(KEY-WP-0016). The browser grant validated PKCE, client id and scopes but left
four bindings unenforced, and UserInfo verified less than the caller CLI does.

Authorization-code path: bind the exchange to the redirect URI the code was
issued for, refuse clients whose registration does not permit the grant, and
authenticate confidential clients with a digest-based constant-time comparison
over the same credential sources as the service grant. An empty grantTypes stays
an implicit authorization-code client, matching config validation.

Code consumption: SessionStore.Consume reads and deletes under one lock. The
previous Get/Delete pair spanned JWT signing, and the added test reproduces the
race against that version -- 9 of 16 concurrent exchanges succeeded, and a
failed exchange left the code replayable.

UserInfo: check the JOSE header algorithm before trusting the signature, require
the configured issuer, and require an access token rather than accepting an ID
token of the right shape. Purpose is decided on the scope claim so the issued
token contract, which consumers pin exactly, does not change.

SCOPE.md and the assessment record which bindings are now enforced and that the
Authelia upstream-trust assumption remains open, so G01 is not fully closed and
no profile-conformance claim is made.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

2026-09-06 22:43:47 +02:00

9.3 KiB

Raw Blame History

Work Records — key-cape

Generated by statehub fix-consistency (CUST-WP-0061-T04, work-record stage 3). Do not edit by hand — edit the source file/block listed for each record and re-run fix-consistency to refresh this index. Archived workplans are omitted; closed decisions/intakes/engagements stay listed so recently-resolved work is still visible. [auto]

Kind	ID	Status	Lane	Source
workplan	ADHOC-2026-09-05	finished	—	workplans/ADHOC-2026-09-05.md
workplan	KEY-WP-0001	finished	—	workplans/KEY-WP-0001-keycape-implementation.md
workplan	KEY-WP-0002	finished	—	workplans/KEY-WP-0002-container-image-gitea.md
workplan	KEY-WP-0003	finished	—	workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md
workplan	KEY-WP-0004	finished	—	workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
workplan	KEY-WP-0005	finished	—	workplans/KEY-WP-0005-iam-profile-core-claims.md
workplan	KEY-WP-0006	finished	—	workplans/KEY-WP-0006-client-credentials-service-tokens.md
workplan	KEY-WP-0007	finished	—	workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
workplan	KEY-WP-0008	finished	—	workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md
workplan	KEY-WP-0009	blocked	—	workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md
workplan	KEY-WP-0010	finished	—	workplans/KEY-WP-0010-openbao-operator-loopback-callback.md
workplan	KEY-WP-0011	finished	—	workplans/KEY-WP-0011-live-secret-exposure-recovery.md
workplan	KEY-WP-0012	finished	—	workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
workplan	KEY-WP-0013	blocked	—	workplans/KEY-WP-0013-approval-engine-resource-audience.md
workplan	KEY-WP-0014	blocked	—	workplans/KEY-WP-0014-native-credential-lane-handoff.md
workplan	KEY-WP-0015	finished	—	workplans/KEY-WP-0015-scope-intent-assessment.md
task	ADHOC-2026-09-05-T01	done	—	workplans/ADHOC-2026-09-05.md
task	KEY-WP-0001-T01	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T02	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T03	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T04	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T05	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T06	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T07	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T08	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T09	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T10	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T11	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T12	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T13	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T14	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T15	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T16	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T17	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T18	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T19	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T20	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T21	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T22	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0001-T23	done	—	workplans/KEY-WP-0001-keycape-implementation.md
task	KEY-WP-0002-T01	done	—	workplans/KEY-WP-0002-container-image-gitea.md
task	KEY-WP-0002-T02	done	—	workplans/KEY-WP-0002-container-image-gitea.md
task	KEY-WP-0002-T03	done	—	workplans/KEY-WP-0002-container-image-gitea.md
task	KEY-WP-0002-T04	done	—	workplans/KEY-WP-0002-container-image-gitea.md
task	KEY-WP-0002-T05	done	—	workplans/KEY-WP-0002-container-image-gitea.md
task	KEY-WP-0002-T06	done	—	workplans/KEY-WP-0002-container-image-gitea.md
task	KEY-WP-0003-T01	done	—	workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md
task	KEY-WP-0003-T02	done	—	workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md
task	KEY-WP-0003-T03	done	—	workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md
task	KEY-WP-0003-T04	done	—	workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md
task	KEY-WP-0003-T05	done	—	workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md
task	KEY-WP-0004-T01	done	—	workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
task	KEY-WP-0004-T02	done	—	workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
task	KEY-WP-0004-T03	done	—	workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
task	KEY-WP-0004-T04	done	—	workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
task	KEY-WP-0004-T05	done	—	workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
task	KEY-WP-0004-T06	cancel	—	workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
task	KEY-WP-0004-T07	done	—	workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
task	KEY-WP-0005-T01	done	—	workplans/KEY-WP-0005-iam-profile-core-claims.md
task	KEY-WP-0005-T02	done	—	workplans/KEY-WP-0005-iam-profile-core-claims.md
task	KEY-WP-0005-T03	done	—	workplans/KEY-WP-0005-iam-profile-core-claims.md
task	KEY-WP-0006-T01	done	—	workplans/KEY-WP-0006-client-credentials-service-tokens.md
task	KEY-WP-0006-T02	done	—	workplans/KEY-WP-0006-client-credentials-service-tokens.md
task	KEY-WP-0006-T03	done	—	workplans/KEY-WP-0006-client-credentials-service-tokens.md
task	KEY-WP-0006-T04	done	—	workplans/KEY-WP-0006-client-credentials-service-tokens.md
task	KEY-WP-0006-T05	done	—	workplans/KEY-WP-0006-client-credentials-service-tokens.md
task	KEY-WP-0007-T01	done	—	workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
task	KEY-WP-0007-T02	done	—	workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
task	KEY-WP-0007-T03	done	—	workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
task	KEY-WP-0008-T01	done	—	workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md
task	KEY-WP-0008-T02	done	—	workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md
task	KEY-WP-0008-T03	done	—	workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md
task	KEY-WP-0008-T04	done	—	workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md
task	KEY-WP-0009-T01	done	—	workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md
task	KEY-WP-0009-T02	done	—	workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md
task	KEY-WP-0009-T03	done	—	workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md
task	KEY-WP-0009-T04	wait	—	workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md
task	KEY-WP-0010-T01	done	—	workplans/KEY-WP-0010-openbao-operator-loopback-callback.md
task	KEY-WP-0011-T01	done	—	workplans/KEY-WP-0011-live-secret-exposure-recovery.md
task	KEY-WP-0011-T02	done	—	workplans/KEY-WP-0011-live-secret-exposure-recovery.md
task	KEY-WP-0011-T03	done	—	workplans/KEY-WP-0011-live-secret-exposure-recovery.md
task	KEY-WP-0012-T01	done	—	workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
task	KEY-WP-0012-T02	done	—	workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
task	KEY-WP-0012-T03	done	—	workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
task	KEY-WP-0013-T01	done	—	workplans/KEY-WP-0013-approval-engine-resource-audience.md
task	KEY-WP-0013-T02	wait	—	workplans/KEY-WP-0013-approval-engine-resource-audience.md
task	KEY-WP-0013-T03	done	—	workplans/KEY-WP-0013-approval-engine-resource-audience.md
task	KEY-WP-0013-T04	done	—	workplans/KEY-WP-0013-approval-engine-resource-audience.md
task	KEY-WP-0014-T01	done	—	workplans/KEY-WP-0014-native-credential-lane-handoff.md
task	KEY-WP-0014-T02	done	—	workplans/KEY-WP-0014-native-credential-lane-handoff.md
task	KEY-WP-0014-T03	done	—	workplans/KEY-WP-0014-native-credential-lane-handoff.md
task	KEY-WP-0014-T04	wait	—	workplans/KEY-WP-0014-native-credential-lane-handoff.md
task	KEY-WP-0015-T01	done	—	workplans/KEY-WP-0015-scope-intent-assessment.md
intake	KEY-IN-0001	closed	—	intakes/intakes.md

9.3 KiB Raw Blame History

Work Records — key-cape

9.3 KiB

Raw Blame History