[mckaragoz]

Summary

Strengthens device-bound session validation by enforcing the configured DeviceMismatchBehavior when device identifiers are missing or mismatched.

Changes

• Reject missing or mismatched device identifiers when DeviceMismatchBehavior is Reject.
• Preserve existing Allow and AllowAndRebind behavior without introducing automatic rebinding.
• Forward the resolved Device ID during Resource API remote session validation.
• Add focused regression tests for local and remote session validation.

Compatibility

• No public API or authentication mode changes.
• Existing session, chain, root, and tenant validation rules remain unchanged.
• Browser navigation and Resource API authentication flows must remain functional.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.20%. Comparing base (95d75d4) to head (e398fd9).
⚠️ Report is 1 commits behind head on dev.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #147      +/-   ##
==========================================
+ Coverage   87.17%   87.20%   +0.02%     
==========================================
  Files         580      580              
  Lines       18890    18891       +1     
  Branches     2227     2227              
==========================================
+ Hits        16468    16474       +6     
+ Misses       1620     1615       -5     
  Partials      802      802              

Flag	Coverage Δ
framework	87.20% <100.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.