fix(oauth2): close id_token_hint auth bypass and login-loop regression - #158

Merged

smarcet merged 9 commits into

mainfrom

hotfix/reload_session

Sep 22, 2026

Commits on Sep 22, 2026

fix(reload-session): reload session from user_id provided from id token
smarcet
committed
cfb6614
fix(oauth2): reject unsigned id_token_hint and stop login loop on hint failure
smarcet
committed
e913375
test(oauth2): cover unsigned id_token_hint rejection and login-loop fix
smarcet
committed
2f326a7
fix(auth): honor canLogin() and fail closed in reloadSession fallback
smarcet
committed
ef1bcf0
fix(oauth2): validate id_token_hint expiration and register IDP principal
smarcet
committed
4a69b0b
fix(oauth2): only unlock id_token_hint sub fallback for IDP-signed hints
smarcet
committed
dd611cf
fix(oauth2): reject id_token_hint with exp == now or without sub
smarcet
committed
fcc3c73
fix(oauth2): register hint auth_time on id_token_hint sub fallback
smarcet
committed
63d8050
refactor(auth): pass id_token_hint reload semantics as a SessionReloadHint value object
smarcet
committed
3cfb61e