tegwick 11ce29af8b Enforce login freshness in KeyCape instead of forwarding prompt=login (KEY-WP-0033). ... Authelia 4.38 refuses prompt=login for every real login because it registers the authorization request after authentication. Send a bounded max_age upstream and check the verified upstream auth_time against prompt=login / max_age in the callback, failing closed when auth_time is missing. Also update the service-client example count left stale by 651625c/1620ce2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 352750@bnt-lap001 Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b		2026-09-23 21:59:21 +02:00
..
account.go	Allow registered provider redirects after sign-out confirmation	2026-09-12 10:47:33 +02:00
account_test.go	Allow registered provider redirects after sign-out confirmation	2026-09-12 10:47:33 +02:00
assurance_time_test.go	Answer the approver-client questions, and fix what checking them turned up	2026-09-09 14:25:38 +02:00
audience_test.go	Add bounded resource audiences and enforce browser scope grants	2026-09-05 00:41:17 +02:00
authorize.go	Enforce login freshness in KeyCape instead of forwarding prompt=login (KEY-WP-0033).	2026-09-23 21:59:21 +02:00
authorize_test.go	Enforce login freshness in KeyCape instead of forwarding prompt=login (KEY-WP-0033).	2026-09-23 21:59:21 +02:00
discovery.go	Carry the tenant claim's provenance, and correct a guard the ruling voided	2026-09-10 07:58:29 +02:00
discovery_test.go	Carry the tenant claim's provenance, and correct a guard the ruling voided	2026-09-10 07:58:29 +02:00
handoff.go	Finish KEY-WP-0008: registration handoff and client MFA isolation	2026-08-16 01:05:27 +02:00
handoff_test.go	Finish KEY-WP-0008: registration handoff and client MFA isolation	2026-08-16 01:05:27 +02:00
hardening_test.go	Harden the authorization-code grant and UserInfo verification	2026-09-06 22:43:47 +02:00
human_tenant_test.go	Carry the tenant claim's provenance, and correct a guard the ruling voided	2026-09-10 07:58:29 +02:00
jwks.go	feat: implement T05, T08, T13 — OIDC discovery, JWKS, telemetry pipeline	2026-03-13 01:35:34 +01:00
jwks_test.go	feat: implement T05, T08, T13 — OIDC discovery, JWKS, telemetry pipeline	2026-03-13 01:35:34 +01:00
login_session.go	Finish KEY-WP-0008: registration handoff and client MFA isolation	2026-08-16 01:05:27 +02:00
logout.go	Finish KEY-WP-0008: registration handoff and client MFA isolation	2026-08-16 01:05:27 +02:00
native_optional_test.go	Implement scoped P06 authentication policy and guarded optional onboarding	2026-09-14 00:00:05 +02:00
optional_mfa_test.go	Support opt-in MFA per browser client with authoritative enrollment checks	2026-09-13 00:27:28 +02:00
policy_isolation_test.go	Finish KEY-WP-0008: registration handoff and client MFA isolation	2026-08-16 01:05:27 +02:00
policy_runtime_test.go	Implement scoped P06 authentication policy and guarded optional onboarding	2026-09-14 00:00:05 +02:00
principal_type_guard_test.go	Close T04 and pin the single route by which a principal becomes human	2026-09-10 23:05:16 +02:00
session.go	Answer the approver-client questions, and fix what checking them turned up	2026-09-09 14:25:38 +02:00
tenant_precondition_test.go	Carry the tenant claim's provenance, and correct a guard the ruling voided	2026-09-10 07:58:29 +02:00
tenant_test.go	Align approval registrations to the tenant:platform decision	2026-09-06 22:30:32 +02:00
token.go	Carry the tenant claim's provenance, and correct a guard the ruling voided	2026-09-10 07:58:29 +02:00
token_test.go	Harden the authorization-code grant and UserInfo verification	2026-09-06 22:43:47 +02:00
userinfo.go	Harden the authorization-code grant and UserInfo verification	2026-09-06 22:43:47 +02:00
userinfo_test.go	Harden the authorization-code grant and UserInfo verification	2026-09-06 22:43:47 +02:00