GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Commit graph

  • 84c54fbb5e Refuse a connection target on sign_in start heimdall/link-initiator-target-binding Heimdall 2026-11-03 13:30:22 +00:00
  • 0f2e294fcb Pin completion expiry at redeem: 410 at and after expiresAt, for any caller and target Heimdall 2026-11-03 09:50:34 +00:00
  • 9f5a0e6938 Bind link mode to its initiator and redeem to its target Heimdall 2026-11-02 13:38:51 +00:00
  • 5146c722af Boot test: fail on a logged publication fault, and require presence at startup main gamecult-chat/heimdall-presence-authority-at-boot Meta Vens 2026-10-23 17:50:37 +02:00
  • 1a36175f3a Presence authority test: the Rust fixture's target is the fixture's own, not heimdall Meta Vens 2026-10-23 17:49:23 +02:00
  • c044155855 Heimdall opens its Idunn presence authority once, before it listens Meta Vens 2026-10-23 17:48:08 +02:00
  • c0d30e8081 Test fixtures: the Rust owner's Idunn runtime records, and one fake Idunn RUDP endpoint Meta Vens 2026-10-23 17:48:02 +02:00
  • e8548614c8 Generation test: bundle the generation process so a uid that cannot read the checkout can run it gamecult-chat/heimdall-state-root-generation-safe Meta Vens 2026-10-23 14:26:13 +02:00
  • 55732a901d Presence: the publisher sequence is in-process, the state root keeps no owner-only file, an Idunn generation never self-enrolls Meta Vens 2026-10-23 14:25:11 +02:00
  • 25d43d1121 Merge security/fastify-upgrade: fastify 5.12.7 advisories Meta Vens 2026-10-22 23:06:25 +02:00
  • 899ea0b8fe Heimdall: fastify 5.8.5 to 5.12.7, find-my-way 9.5.0 to 9.10.0 (clears 5 High advisories) security/fastify-upgrade Meta Vens 2026-10-22 21:00:47 +02:00
  • c15fb97706 Test: malformed URL must not reach a sibling prefix's not-found handler (GHSA-p68q-wchp-6fh7) Meta Vens 2026-10-22 21:00:46 +02:00
  • 4185e657bb Tests: state time windows to the second, requested_scopes shapes, the launch route's validation, the phases each route claims gamecult-chat/heimdall-binds-completion Meta Vens 2026-10-22 20:25:52 +02:00
  • 5076e04950 Docs: the launch hop, the binding cookie and the callback refusals Meta Vens 2026-10-22 20:13:18 +02:00
  • 3def0fb426 OAuth states complete once, only in the browser that launched them: a launch hop sets a signed binding cookie, launch and callback each consume the state, and the callback checks expiry Meta Vens 2026-10-22 20:13:17 +02:00
  • 14e0cde26c Store: claimOAuthStateUse claims one use of a signed OAuth state per (jti, phase), on both stores and an INSERT-only table Meta Vens 2026-10-22 20:13:16 +02:00
  • 607c2b0a20 Depend on @fastify/cookie for the OAuth binding cookie Meta Vens 2026-10-22 20:13:16 +02:00
  • c1dfe15dd5 Merge readme-front-door: README opens with value, problem, entry points, live versus planned Meta Vens 2026-10-22 20:04:06 +02:00
  • c7cf78bbbc README: front door with value, problem, entry points, live versus planned readme-front-door Meta Vens 2026-10-22 20:03:50 +02:00
  • ece6ba1d62 Tests: a state completes once and only in the browser that launched it; the gate holds for every mode, provider and handoff (red against the callback that accepts any signed state) Meta Vens 2026-10-22 19:04:10 +02:00
  • 9fd152feff Tests: a foreign app's caller cannot start a Bifrost flow, with no policy attached Meta Vens 2026-10-22 18:24:42 +02:00
  • ed964201d4 Docs: startRequiresAppCaller, and Heimdall authenticates while Bifrost issues identity Meta Vens 2026-10-22 18:14:37 +02:00
  • 7e17a0e952 Start: a profile with startRequiresAppCaller refuses unauthenticated starts; set on Bifrost Meta Vens 2026-10-22 18:14:37 +02:00
  • 6d43eacd84 Tests: apps that bind browser completion refuse unauthenticated starts (red; does not pass yet) Meta Vens 2026-10-22 18:13:02 +02:00
  • 5952cce8a0 State: live d51fa6b proven by a human Twitch sign-in; Joystick consent remains Meta Vens 2026-10-19 18:03:17 +02:00
  • 30a1ace6fd State: close eureka/joystick-h1 as accepted (merged, PR #1) Meta Vens 2026-10-19 17:56:34 +02:00
  • df05570ef6 State: Joystick H1 merged and live at d51fa6b; follow-ups recorded by id Meta Vens 2026-10-19 17:56:25 +02:00
  • d51fa6b999
         Merge pull request #1 from GameCult/eureka/joystick-h1 Meta Vens 2026-10-19 17:47:39 +02:00
  • 778eabaedc Docs: map managed credential custody, the callback mint and the open follow-ups eureka/joystick-h1 Meta Vens 2026-10-19 15:49:34 +02:00
  • 6db84bfae8 Pin the year boundary, the typed exchange failure and the start refusal's code Meta Vens 2026-10-19 14:45:35 +02:00
  • 1d856ebd40 Code exchange: a rotating provider's grant without a refresh token fails the callback Meta Vens 2026-10-19 14:35:11 +02:00
  • 4e312828c3 Pin the handoff strip: a custody-only backend_callback delivery carries no refresh token Meta Vens 2026-10-19 14:34:44 +02:00
  • 09ea233592 Token answers: an expires_in beyond a year is unusable, so the default lifetime applies Meta Vens 2026-10-19 14:34:43 +02:00
  • e1ac84fb70 Joystick custody needs a creator binding, at start and at the callback Meta Vens 2026-10-19 14:34:24 +02:00
  • 26f264877a Pin the hybrid capability listing a viewer sign-in carries Meta Vens 2026-10-19 14:04:12 +02:00
  • a911da93d8 Claims: facts are the one owner of a capability-free claim Meta Vens 2026-10-19 13:34:41 +02:00
  • 655fcc7d22 Credential rotate decisions carry a required expiry Meta Vens 2026-10-19 13:29:10 +02:00
  • 32208cc8e2 Pin the callback's refusal of a signed state the provider has no role for Meta Vens 2026-10-19 13:27:28 +02:00
  • a32be41878 Token answers: a default lifetime replaces an unknown expiry; a malformed refresh_token is typed Meta Vens 2026-10-19 13:24:21 +02:00
  • 79ea0007d3 OAuth callback: mode and provider role decide what a completion mints Meta Vens 2026-10-19 13:23:53 +02:00
  • 6bdaed2a9b Token set check: drop the array clause the access_token check already decides Meta Vens 2026-10-19 12:44:20 +02:00
  • c1fbc1261a OAuth start: connect keeps admitting identity providers, as Bifrost uses it Meta Vens 2026-10-19 12:38:13 +02:00
  • b15bf33b21 Refresh: one attempt per identity per process; waiters share its outcome Meta Vens 2026-10-19 12:34:39 +02:00
  • d989860163 Refresh classification: revoke only on a 400 invalid_grant; any other answer keeps the tokens Meta Vens 2026-10-19 12:34:17 +02:00
  • c554c00697 OAuth start: the profile's role lists decide which provider a mode may use Meta Vens 2026-10-19 12:31:59 +02:00
  • 34a8c6a81d Tests: a late decider still queues behind the one waiting on the in-memory chain Meta Vens 2026-10-19 11:52:27 +02:00
  • 6b8c4a9c63 Tests: pin the refresh fast paths, boundaries and connection hygiene Meta Vens 2026-10-19 11:47:37 +02:00
  • 9b3d44f56a Tests: satisfy exactOptionalPropertyTypes in the Joystick stub Meta Vens 2026-10-19 11:25:01 +02:00
  • f6baadec0c Tests: refresh failures surface as the typed ManagedCredentialRefreshFailed; seven providers Meta Vens 2026-10-19 11:20:18 +02:00
  • 7ce9588503 Postgres store: return created_at and updated_at as ISO strings too Meta Vens 2026-10-19 11:18:12 +02:00
  • 3eaa9ef265 Declare Joystick in the Idunn recipe and document the locked refresh Meta Vens 2026-10-19 11:15:42 +02:00
  • 43b7072dfb Postgres store: return token_expires_at as the ISO string the port promises Meta Vens 2026-10-19 11:15:12 +02:00
  • 1c38d12050 Add Joystick as a confidential, rotating managed-connection provider Meta Vens 2026-10-19 11:13:40 +02:00
  • c81f923890 Refresh managed credentials under a row lock, with typed revocation Meta Vens 2026-10-19 11:11:34 +02:00
  • 0dbcd98019 Collapse ten per-provider token functions into one descriptor-driven request Meta Vens 2026-10-19 11:06:32 +02:00
  • 2108d1088b Handoff: rehydrate with plain python, not the repixelizer venv on E: Meta Vens 2026-10-19 10:44:29 +02:00
  • 8066bcbbee State: Joystick H1 is the active cut; Ghostlight canaries demoted behind it Meta Vens 2026-10-19 10:44:24 +02:00
  • 7904e17cd2 Pin the predicate splitter on a quoted identifier hands/secrets-followup Meta Vens 2026-09-30 23:18:53 +02:00
  • 996f21f58c Schema check: deterministic column collations, a named TEMP refusal, and kills for the printer Meta Vens 2026-09-30 22:52:41 +02:00
  • 588739857a Schema: name what the startup check does not prove Meta Vens 2026-09-30 22:52:40 +02:00
  • d029e08a2e Recipe test: explore loadConfig as Idunn starts Heimdall Meta Vens 2026-09-30 22:52:40 +02:00
  • ca2366cecf Schema check: validity is the rule; pin the printed predicates hands/secret-files Meta Vens 2026-09-30 21:28:50 +02:00
  • 97632b7cfa Print the declared predicates in a module function, not a store method Meta Vens 2026-09-30 21:11:18 +02:00
  • eff5098c23 Schema check: the collation alias is not a reserved word Meta Vens 2026-09-30 20:58:29 +02:00
  • d2ac9696c7 Recipe test: combined runs from accepted values, config literals as probes, fresh import Meta Vens 2026-09-30 20:40:13 +02:00
  • 0444360733 Schema check: valid, deterministic keys; Postgres-printed predicates; column grants; nullability Meta Vens 2026-09-30 20:40:12 +02:00
  • 6c0c87669f Schema check: a unique key is matched by shape, not name; quiet fixture pools Meta Vens 2026-09-30 19:30:40 +02:00
  • fd98e36186 Recipe test: explore loadConfig's branches, refuse environment copies Meta Vens 2026-09-30 18:58:02 +02:00
  • 35f804f7ef Pin provider errors and Bifrost's reply exactly; defend errorIdentity's filters Meta Vens 2026-09-30 18:57:17 +02:00
  • 963150f537 Audit events never carry a completion code Meta Vens 2026-09-30 18:56:35 +02:00
  • 731ce08cfa Schema check: keys as the store relies on them, typed columns, per-table privileges Meta Vens 2026-09-30 18:55:45 +02:00
  • b5d7b6b0cc A refused store closes its pool; pin the key's columns and uniqueness Meta Vens 2026-09-30 17:29:19 +02:00
  • 804f41f5f7 Pin that no provider error carries the provider's body Meta Vens 2026-09-30 17:16:39 +02:00
  • 7be541467d Schema check: a key is a unique index on its columns, primary or not Meta Vens 2026-09-30 17:16:21 +02:00
  • 8541ae3f2f Startup proves the database can take Heimdall's writes Meta Vens 2026-09-30 17:15:34 +02:00
  • 48915317ef Recipe test observes the secrets loadConfig reads Meta Vens 2026-09-30 17:09:20 +02:00
  • 2e06678301 Patron support sync keeps Bifrost's answer by status alone Meta Vens 2026-09-30 17:08:29 +02:00
  • b5b980578c Backend handoff failure names the status, never the app's answer Meta Vens 2026-09-30 17:07:45 +02:00
  • 698f5dfc0e Private command diagnostics carry class and code, never a message Meta Vens 2026-09-30 17:07:16 +02:00
  • efd11373b8 Audit event keeps a provider's HTTP status, never its body Meta Vens 2026-09-30 16:03:57 +02:00
  • f94729f5f7 Relay's error description is set only when one survives Meta Vens 2026-09-30 15:50:58 +02:00
  • 7c14414cd2 The failed-callback audit event keeps the error's class and code Meta Vens 2026-09-30 15:49:32 +02:00
  • 7de12e84be Relayed provider errors are printable, bounded and inert in the page Meta Vens 2026-09-30 15:49:30 +02:00
  • cad12165a9 A start that does not apply the schema proves the schema is there Meta Vens 2026-09-30 15:49:23 +02:00
  • 869802126c Pin the 4xx branch of the error handler with a thrown error Meta Vens 2026-09-30 15:37:11 +02:00
  • ca2e78f00c Recipe test reads its secret names from the source Meta Vens 2026-09-30 15:30:18 +02:00
  • c626a86d55 A lost idle Postgres connection no longer kills Heimdall Meta Vens 2026-09-30 15:30:15 +02:00
  • 0f5ffd9e69 Every start connects to Postgres; pin the signing key's read refusal Meta Vens 2026-09-30 15:30:10 +02:00
  • 33afcbf364 HTTP error answers carry fixed text, never an error's message Meta Vens 2026-09-30 15:30:06 +02:00
  • 376dfbd2c2 Startup database failure names the input and a code, not the URL's parts Meta Vens 2026-09-30 14:46:22 +02:00
  • 83d2f48256 Docs: secrets are _FILE names; drop the unread Spotiverse secret Meta Vens 2026-09-30 14:40:21 +02:00
  • 2800d88d10 Pin the recipe's secret declarations, and declare every app secret file Meta Vens 2026-09-30 14:40:21 +02:00
  • d73a26dfd1 Pin no-leak at the terminal: run the real entrypoint with canaries Meta Vens 2026-09-30 14:40:21 +02:00
  • e091bb3fd1 Signing key path: absolute only, and no error carries the path Meta Vens 2026-09-30 14:40:07 +02:00
  • e35441e378 Pin the token-key length refusal custody now relies on Meta Vens 2026-09-30 14:03:24 +02:00
  • fe26208f05 Docs and .env.example teach secrets as NAME_FILE credential files Meta Vens 2026-09-30 13:52:11 +02:00
  • f8ff2b26ba Declare the GitHub and Spotify client-secret files the witness publishes Meta Vens 2026-09-30 13:51:18 +02:00
  • 0178d071c1 readSecretInput: never print the path, refuse relative paths and blank secrets Meta Vens 2026-09-30 13:50:53 +02:00
  • 9f0cd73299 Pin the newline and storage-selection rules StrykerJS found undefended Meta Vens 2026-09-30 12:49:23 +02:00
  • ac86352972 Read every secret input from a credential file named by NAME_FILE Meta Vens 2026-09-30 12:30:57 +02:00