Join Forgejo callback identity to the issuer-owned current access grant

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7

build/forgejo/inputs.lock.json

@@ -3,13 +3,13 @@
   "forgejo_version": "11.0.3",
   "source_archive_sha256": "1ddd8c926ca07d40436897971458ace7dcf1d3496a0813ab9e0d869edef2365c",
   "source_commit": "b81aa4d0807cc1e2d6a2fbafd0b75c46cc0ae237",
-  "patch_sha256": "feb1079399a43989742ae0a946c1ada50113d1821e6541f97f0b5592ee1fc20c",
+  "patch_sha256": "9fe3d7baa648c9347964a177befab5070e00151d1ec5ddff16c41890db84e62a",
   "go_archive_sha256": "3333f6ea53afa971e9078895eaa4ac7204a8c6b5c68c10e6bc9a33e8e391bdd8",
   "go_version": "1.24.3",
   "node_archive_sha256": "dafe2e8f82cb97de1bd10db9e2ec4c07bbf53389b0799b1e095a918951e78fd4",
   "node_version": "22.15.0",
   "source_date_epoch": 1752105237,
-  "release_version": "11.0.3+cust80.feb10793",
+  "release_version": "11.0.3+cust80.9fe3d7ba",
   "tags": "bindata timetzdata sqlite sqlite_unlock_notify",
   "runtime_base": "code.forgejo.org/forgejo/forgejo@sha256:41649dff5311664097d29b4d80620403f0b27e7c0eee0b8af79b132a37f3807b",
   "runtime_index_digest": "sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba",
@@ -33,7 +33,7 @@
     },
     {
       "path": "go.mod",
-      "sha256": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a"
+      "sha256": "11fe525ccb3f099aa281738b86097bbd587a99b4640ddae8dd04dd7d046c49f0"
     },
     {
       "path": "models/auth/source_operation.go",
@@ -93,7 +93,7 @@
     },
     {
       "path": "services/auth/source/oauth2/access_engine.go",
-      "sha256": "d5f07f9491ac2212410e1fa8c0248d68ba3a723e7ca99e363627c5292d187aa8"
+      "sha256": "d16330043825d0284253e65d28bda2de4edbc633e4887d8c3618a106ee251daa"
     },
     {
       "path": "services/auth/source/oauth2/access_engine_assurance.go",
@@ -109,11 +109,27 @@
     },
     {
       "path": "services/auth/source/oauth2/access_engine_callback_test.go",
-      "sha256": "5cea36b630c895a9473dc876b7128526ddef65d9395b2fddc56343e162452472"
+      "sha256": "1cbe378cc20149be7b354484ab3297916733564f03a2441cd276f9039d043580"
+    },
+    {
+      "path": "services/auth/source/oauth2/access_engine_current_token.go",
+      "sha256": "4a2e484ece7cf74686173d5e85c127643287570c2298af135ddfdc7c450b18d8"
+    },
+    {
+      "path": "services/auth/source/oauth2/access_engine_current_token_test.go",
+      "sha256": "58f799c08a7b4638780abc511bd1a7359bd5e691c7805ff54582d02d2f42cae1"
+    },
+    {
+      "path": "services/auth/source/oauth2/access_engine_purpose_test.go",
+      "sha256": "533dc3153fcf9bfcf7bfc08712c057092c7b3892882f217fb8f839fdbdd99939"
     },
     {
       "path": "services/auth/source/oauth2/access_engine_test.go",
-      "sha256": "99edd6cfe3e834d73e0447a7915f52cc4ab7b82644669c5ae61963f850b447e8"
+      "sha256": "9112a142983c0a58c5d40344b58a20fa2c1bdbc7a79b5c586796362839a43b48"
+    },
+    {
+      "path": "services/auth/source/oauth2/current_issuer_fixture_test.go",
+      "sha256": "24fb430e72848326c5d9ef42eab5028cf915dd601f43fb06010b32b568908781"
     },
     {
       "path": "services/auth/source/oauth2/providers_openid.go",
@@ -174,10 +190,30 @@
     {
       "path": "third_party/access-engine-pep/testsupport/signfixture/sign.go",
       "sha256": "fe4aa86f444dc20145aefbaca35b24f046264b2c5c8b4e3b057a4496b77a4d29"
+    },
+    {
+      "path": "third_party/keycape-tokenstatus/LICENSE",
+      "sha256": "ff413f361a3b3bf44cf50f110fbcc4837064d57eefbcef89df2b43997c6262b6"
+    },
+    {
+      "path": "third_party/keycape-tokenstatus/go.mod",
+      "sha256": "e8b028e1002e63a76dba78a4abbd67882307ad198e4783bad631652061aa0f54"
+    },
+    {
+      "path": "third_party/keycape-tokenstatus/internal/jose/jose.go",
+      "sha256": "a6de154cd81e34a521b8aac5dce6b45a3cfb015681ed16e2beb8f2a24c72c00d"
+    },
+    {
+      "path": "third_party/keycape-tokenstatus/pkg/tokenstatus/client.go",
+      "sha256": "f34626a85d67590b9c61474f19ce1021f8afd17093f8f522b3f98e9cef34e575"
+    },
+    {
+      "path": "third_party/keycape-tokenstatus/producer-source.json",
+      "sha256": "3bd9b25b912e7c17b331997ca5fee9da8a7c314f336e09e3c116885954799b73"
     }
   ],
   "lockfiles": {
-    "go.mod": "130138c4c3ecc29fa0d7f1e2eef0589ddf3b06071f3cc0448aa7b2326847653a",
+    "go.mod": "11fe525ccb3f099aa281738b86097bbd587a99b4640ddae8dd04dd7d046c49f0",
     "go.sum": "19c305c7e68de9d3f1bc0dda2de09c5d38597f1ee7fa411c7b36b92467ae1eaf",
     "package.json": "ab5c54ec7077501b50acf3ab5f1fff4f63a51abe99e720b8ecdc6cc6c78f39fc",
     "package-lock.json": "fdd5c2f891311be7c01b1907b418c243ca1f0f951fd4b4ee5b5e931c43493657"
@@ -193,7 +229,7 @@
   },
   "runtime_base_config_sha256": "bc5a3df111729582faadebd01d126ba769e2b65d0c62f306f6bc79f4e562452b",
   "patch_file": "forgejo-security-extension.patch",
-  "candidate_review_status": "coordinator tested; independent owner review pending",
+  "candidate_review_status": "current-token callback source tested; complete release rebuild and independent owner review pending",
   "producer_source_commit": "ca0cb75729a63c9288b7333382d0fa3eb1e8c9a3",
   "optional_source_tests": {
     "source_operation_postgres": {
@@ -202,5 +238,7 @@
       "source_only": true,
       "production_connection_or_credentials": false
     }
-  }
+  },
+  "identity_client_source_revision": "git:08c083bae9ff35fbaf028c36d72a95b57d2541b7",
+  "identity_issuer_source_revision": "git:e2c5a947829568baf837543a6708fd0c3f6a863b"
 }