tegwick
911e9de969
completeAuthorization reused an existing kc_login session's IssuedAt as authTime whenever one existed for the same user, even at the two call sites that had just validated an MFA token in this exact request. A platform-root sign-in that stepped up with fresh MFA while an older browser session cookie was still around got that older timestamp stamped onto the new authentication, understating freshness for every downstream binding-grade check (flex-auth's 900s review window denied informed-decision's infd-20260927-b01 approval as a result). Add a freshMFA parameter so only the carried-forward-assurance call site (no MFA challenge in this request) reuses the prior session's IssuedAt; the two call sites following a successful MFA.ValidateMFAToken always stamp authTime to now. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 169987@bnt-lap001 Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999 |
||
|---|---|---|
| .. | ||
| adapters | ||
| authclient | ||
| config | ||
| domain | ||
| errors | ||
| jose | ||
| migration | ||
| server | ||
| validator | ||