feat(oauth): implement server-side OAuth C1-C6 for native companion client
C1: native-client authorization path minting web-session JWTs (issueToken shape), scopes bound to scopesForRole(role); mcp_access path left untouched. C2: native refresh backed by refresh-token-core (rotation + reuse→family-revoke); token in response body (no cookie); reason codes aligned to auth-session.mjs. C3: emit iss = issuer identifier on loopback redirect in both completeMcpAuthorization and completeNativeAuthorization, equal to discovery metadata issuer. C4: durable pending auth codes in native-as-store.mjs (atomic JSON, survives restart); native refresh tokens via shared createGatewayRefreshStore(). C5: redirect_uri validated at token exchange (RFC 6749 §4.1.3); loopback-only URIs enforced at registration (RFC 8252 §7.3); SDK v1.27.1 variable-port loopback verified. C6: applyScopeCeiling() guards every token-mint path; unknown role → member ceiling; applied at code exchange and on every refresh rotation.
86/86 tests green across 7 tiers (unit, integration, e2e, stress, data-integrity, performance, security). Gate doc §6 updated to mark all Cx implemented.
Semantic Changes
72 symbols
Files Changed
+777
777 in snapshot
0 comments
muse hub commit comment sha256:318515b93ac360aca1898df0968e5dff8c416434a091b5da372ce632745f705a --body "your comment"
No comments yet. Be the first to start the discussion.