feat(oauth): add Enterprise-Managed Authorization (ID-JAG)#258

Open

appleboy wants to merge 18 commits into

mainfrom

worktree-enterprise-managed-authorization

Commits on Jun 21, 2026

fix(services): honor revoked app authorization before minting ID-JAGs

appleboy
and
claude
committed
fix(services): bind ID-JAG token-exchange to the user's granted consent

appleboy
and
claude
committed
fix(idjag): harden IdP minting, JWKS cache, and trusted-IdP scheme

appleboy
and
claude
committed
fix(services): lock client type while admin-managed ID-JAG flow is enabled

appleboy
and
claude
committed
fix(idjag): widen synthetic ID-JAG identity suffix to 128 bits

appleboy
and
claude
committed
fix(jwks): preserve HTTPS scheme across redirects and enforce JWK key-use

appleboy
and
claude
committed
fix(idjag): reject empty effective scope when minting ID-JAGs

appleboy
and
claude
committed
fix(idjag): bind ID-JAG resource to consent and honor JWK key_ops

appleboy
and
claude
committed
test(idjag): bind resource consent in token-exchange handler tests

appleboy
and
claude
committed
fix(jwks): reject unsafe RSA public exponents from trusted IdP keys

appleboy
and
claude
committed
fix(idjag): bind minted scope to current client registration; reject ambiguous JWKS kids

appleboy
and
claude
committed
fix(jwks): base no-kid acceptance on usable count; require RS256 RSA alg

appleboy
and
claude
committed
fix(services): lock client scopes while admin-managed ID-JAG flow is enabled

appleboy
and
claude
committed