Harden managed-mode OAuth and session authorization - #2

Merged

christophdb merged 8 commits into

mainfrom

harden-oauth-and-session-auth

Aug 25, 2026

Commits on Aug 25, 2026

feat(auth): add TokenCipher for sealed, self-expiring values

christophdb
and
claude
committed
fe8f702
fix(auth)!: close OAuth token theft and session-ID-only authorization

christophdb
and
claude
committed
2c6e667
docs: document managed-mode auth changes, release 1.6.0

christophdb
and
claude
committed
9af9cb6
chore(deps): lift dependencies flagged by the image scan

christophdb
and
claude
committed
d56cfbb
feat(logging): record the callbacks a client registered

christophdb
and
claude
committed
4368509
feat(logging): make a successful token refresh visible

christophdb
and
claude
committed
fe90cd9
feat(auth): make the access token lifetime configurable

christophdb
and
claude
committed
68b59f5
fix(logging): record the full callback, not only its origin

christophdb
and
claude
committed
57da669