GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests 4 Projects Releases Packages Wiki Activity Actions

OIDC: refuse reserved localparts at authorize; gap list in oidc-issuer.md #49

Merged
heimdall merged 1 commit from self/oidc-reserved-identity into main 2026-11-11 06:39:35 +00:00
Conversation 0 Commits 1 Files changed 4 +95
heimdall commented 2026-11-11 06:35:50 +00:00
Member
Copy link

Window B prerequisite (heimdall-body:follow_up:chat-s6123-6123). Bifrost already is the MAS-shaped OIDC provider (discovery, JWKS, authorize/token/userinfo, PKCE S256, one client, claims -> Matrix-legal localpart, back-channel logout; OidcIssuerTests already drive the full code flow). The one missing cut that closes a takeover class: #34 refuses reserved names at creation, but rows minted before it can still hold one and there is no rename path, so /connect/authorize now answers access_denied for them (the same 28 names as MAS banned_usernames). 8 consumer-side cases (5 reserved incl. casing, 3 look-alikes still get a code); mutating the guard fails the 5.

docs/oidc-issuer.md gets a 'Not built' section: no rate limit or pruning on /connect/* (expired OpenIddict rows are never deleted), no in-process brake, no non-member ('Users', no vote) path, and no upstream_oauth2 block in gamecult-ops. No deploy.

Tests: 6 userinfo/claims cases in OidcIssuerTests fail identically on main in this host (net8 test host rolled forward to .NET 10: PipeWriter ... does not implement UnflushedBytes in TestServer); the rest pass.

🤖 Generated with Claude Code

Window B prerequisite (`heimdall-body:follow_up:chat-s6123-6123`). Bifrost already is the MAS-shaped OIDC provider (discovery, JWKS, authorize/token/userinfo, PKCE S256, one client, claims -> Matrix-legal localpart, back-channel logout; `OidcIssuerTests` already drive the full code flow). The one missing cut that closes a takeover class: #34 refuses reserved names at *creation*, but rows minted before it can still hold one and there is no rename path, so `/connect/authorize` now answers `access_denied` for them (the same 28 names as MAS `banned_usernames`). 8 consumer-side cases (5 reserved incl. casing, 3 look-alikes still get a code); mutating the guard fails the 5. `docs/oidc-issuer.md` gets a 'Not built' section: no rate limit or pruning on `/connect/*` (expired OpenIddict rows are never deleted), no in-process brake, no non-member ('Users', no vote) path, and no `upstream_oauth2` block in gamecult-ops. No deploy. Tests: 6 userinfo/claims cases in `OidcIssuerTests` fail identically on main in this host (net8 test host rolled forward to .NET 10: `PipeWriter ... does not implement UnflushedBytes` in TestServer); the rest pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
heimdall deleted branch self/oidc-reserved-identity 2026-11-11 06:39:35 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Bifrost!49
No description provided.