From e2a4d677d2804a0aaf708541f3127b7940329de5 Mon Sep 17 00:00:00 2001 From: Heimdall Date: Wed, 11 Nov 2026 16:47:54 +0000 Subject: [PATCH] Docs: no refresh token, MAS skips userinfo; withdrawal ends new tokens, not open sessions Co-Authored-By: Claude Sonnet 5.5 --- docs/oidc-issuer.md | 4 ++-- docs/training-notice.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/oidc-issuer.md b/docs/oidc-issuer.md index e6a2eeb..df357ee 100644 --- a/docs/oidc-issuer.md +++ b/docs/oidc-issuer.md @@ -163,8 +163,8 @@ to 15 minutes; a 400 (token refused) or 404 (unknown provider ULID) is a configu and retried at the 15 minute cap. Nothing is revoked until MAS answers 2xx. A restart loses the backoff and nothing else: the authorizations table is the queue, so a later-set URI also catches up on earlier demotions. -Without `BackchannelLogoutUri` none of this runs: suspension stops new sign-ins and token refresh (the authorize, token and userinfo -endpoints refuse a suspended account) but does not end a chat session that is already live, and the issuer logs one warning at +Without `BackchannelLogoutUri` none of this runs: suspension stops new chat tokens (the authorize, token and userinfo +endpoints refuse a suspended account; there is no refresh token, and MAS does not call userinfo) but does not end a chat session that is already live, which runs to its natural expiry, and the issuer logs one warning at startup saying so. The other lever is MAS admin deactivation of the user (ops, not built here). Tradeoff: delivery latency is up to one tick, and a member demoted and re-promoted inside one tick keeps their sessions. diff --git a/docs/training-notice.md b/docs/training-notice.md index a4d1287..39f79ca 100644 --- a/docs/training-notice.md +++ b/docs/training-notice.md @@ -41,7 +41,7 @@ asked again on their next chat sign-in. (not withdrawn) receipt for the version in force exists. After a bump, everyone is out until they agree again. The notice says so ("if the notice changes, its version changes and we ask again; until you agree to the new version, your messages are not used"), and the consent page shows the person that their agreement is to an older version and - offers the new one. Since the chat gate, a bump also ends everyone's chat token until they agree (their next chat sign-in lands on that page). Nobody is emailed or prompted elsewhere; asking is the page's job, and silence means no. + offers the new one. Since the chat gate, a bump also stops new chat tokens for everyone until they agree (their next chat sign-in lands on that page; a session already open runs to its natural expiry unless `BackchannelLogoutUri` is set, when the 30 s reconciler ends it). Nobody is emailed or prompted elsewhere; asking is the page's job, and silence means no. 3. **Withdrawal had no CSRF check.** True. The session cookie's SameSite default is Lax, which already keeps a cross-site POST from carrying it, but nothing in the handler relied on that. Both state changes (agree, withdraw) are now form POSTs refused with 403 unless they came from the site itself (`RequestOriginGuard`, the strict form), before