beardthelion 07c1953ea1 fix(dashboard-auth): pin OIDC discovery to the configured issuer origin ...

_fetch_discovery followed redirects but only pinned the document's
self-asserted issuer field, so one cleartext or attacker-hosted hop
could serve a forged document claiming the configured issuer with
attacker jwks_uri and token_endpoint. Verify then accepted
attacker-signed ID tokens and the code exchange POSTed the client
secret to the attacker's token endpoint.

The resolved response.url must now share the configured issuer's
origin (scheme, host, port with default-port normalisation) before
the body is parsed. Same-origin canonicalisation redirects still
pass, and the issuer-field pin remains as the misconfig check it is.

2026-09-20 00:09:52 -07:00

..

basic

compat(plugins): warn once per name when a plugin resolves an old import path; lint step restored in CI

2026-09-04 00:15:16 -07:00

drain

compat(plugins): warn once per name when a plugin resolves an old import path; lint step restored in CI

2026-09-04 00:15:16 -07:00

nous

compat(plugins): warn once per name when a plugin resolves an old import path; lint step restored in CI

2026-09-04 00:15:16 -07:00

self_hosted

fix(dashboard-auth): pin OIDC discovery to the configured issuer origin

2026-09-20 00:09:52 -07:00

_shared.py

review-fix(comments): restore lost #NNNN rationale comments across non-test source (mechanical sweep, condensed, code unchanged)

2026-09-03 09:44:26 -07:00