giles 9860582b4a identity: OAuth client registry — public/confidential clients + redirect allow-list (11 tests) ...

clients.sx (RFC 6749 §2) — confidential clients must present the correct
secret at the token endpoint (wrong → invalid_client); public clients are
identified but not authenticated; redirect_uris are pre-registered and
checked by exact-match valid_redirect (§3.1.2.2 + Security BCP). Standalone
module for now; wiring confidential-client auth into oauth exchange is a
follow-up. New tests/clients.sx. 149/149.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-07 02:03:44 +00:00

..

tests

identity: OAuth client registry — public/confidential clients + redirect allow-list (11 tests)

2026-06-07 02:03:44 +00:00

api.sx

identity: service facade api.sx — login/verify/revoke/logout (10 tests, Phase 1 complete)

2026-06-07 00:00:05 +00:00

audit.sx

identity: grant audit ledger — issue/refresh/revoke events, queryable per subject (10 tests)

2026-06-07 01:16:18 +00:00

cache.sx

identity: delegated grant-verification cache with generation invalidation (Phase 3 complete, +9)

2026-06-07 01:03:57 +00:00

clients.sx

identity: OAuth client registry — public/confidential clients + redirect allow-list (11 tests)

2026-06-07 02:03:44 +00:00

conformance.sh

identity: OAuth client registry — public/confidential clients + redirect allow-list (11 tests)

2026-06-07 02:03:44 +00:00

federation.sx

identity: trust-gated federated identity + cross-instance mapping (Phase 4 complete, +13)

2026-06-07 01:29:08 +00:00

membership.sx

identity: membership state machine + per-app grant projection (17 tests)

2026-06-07 00:54:51 +00:00

oauth.sx

identity: silent SSO prompt=none fast-path — one session, many clients (10 tests)

2026-06-07 00:45:15 +00:00

registry.sx

identity: session registry — route by id and (subject, client) + SSO fan-out (9 tests)

2026-06-06 23:55:34 +00:00

scoreboard.json

identity: OAuth client registry — public/confidential clients + redirect allow-list (11 tests)

2026-06-07 02:03:44 +00:00

scoreboard.md

identity: OAuth client registry — public/confidential clients + redirect allow-list (11 tests)

2026-06-07 02:03:44 +00:00

session.sx

identity: session-as-process — create/lookup/expire/revoke + idle timeout (11 tests)

2026-06-06 23:45:50 +00:00

token.sx

identity: access-token TTL via logical clock — expires_in (RFC 6749 §4.2.2, +8 tests)

2026-06-07 01:53:19 +00:00