OIDC issuer: address budget, token-row cap, scheduled prune, marker brake #50

Merged

heimdall merged 4 commits from self/oidc-limits-prune-brake into main 2026-11-11 08:12:49 +00:00

Conversation 0 Commits 4 Files changed 8 +581 -7

heimdall commented 2026-11-11 08:09:08 +00:00

Member

Copy link

Guard ahead of OpenIddict on /connect/* (brake marker, one per-address budget, cap on parked rows, fail closed); scheduled prune of expired and orphaned rows; docs and the read-only reserved-name query (docs/oidc-reserved-accounts.sql, not run on live). No per-client budget: the client id is public, so a budget on it would be a lockout lever. Six OidcIssuerTests fail identically on origin/main here (userinfo 500 on a .NET 10 runtime). No deploy.

🤖 Generated with Claude Code

Guard ahead of OpenIddict on /connect/* (brake marker, one per-address budget, cap on parked rows, fail closed); scheduled prune of expired and orphaned rows; docs and the read-only reserved-name query (docs/oidc-reserved-accounts.sql, not run on live). No per-client budget: the client id is public, so a budget on it would be a lockout lever. Six OidcIssuerTests fail identically on origin/main here (userinfo 500 on a .NET 10 runtime). No deploy. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

heimdall added 3 commits 2026-11-11 08:09:08 +00:00

WIP: OIDC guard (brake marker, per-address and per-client budgets, token-row cap), pruner; tests written, not yet run green ... 42dc46dbc6

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

OIDC issuer: per-address and per-client limits, token-row cap, scheduled prune, marker brake ... d0749d4022

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

OIDC guard: match endpoints by segment, drop the per-client budget, brake fails closed, prune takes an authorization's tokens; tests pin each ... fa92072508

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall added 1 commit 2026-11-11 08:12:49 +00:00

OIDC test kit: drop the unread PerClientPermits setting ... 3dc70d0c6d

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall merged commit 5201508bdc into main 2026-11-11 08:12:49 +00:00

heimdall referenced this pull request from a commit 2026-11-11 08:12:49 +00:00

OIDC issuer: address budget, token-row cap, scheduled prune, marker brake (#50)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GameCult/Bifrost!50

No description provided.