H1b: code-in-body cross-app exchange endpoint (re-land of #23) - #28
Merged
Conversation
Second hardened slice of the Tuvens integration (#16, #17): - CrossAppAuthAction reduced to a single exchange: POST /auth/cross-app/validate with {"code"} in the JSON body. The code is read strictly from the body (query-string values are ignored), validated server-to-server via SecureCrossAppAuthService, and exchanged for a hi.events JWT carrying an account_id claim, using the same response shape as regular login. - Removed: mock_session_* bypass, status/accounts/validate-permission endpoints (superseded by the one-time-code seam), token logging, and all query-param token reads. - config/app.php frontend_url is env-only (no localhost fallback). - CrossAppAuthenticationTest rewritten for the new contract (10 tests): exchange success incl. account+organizer provisioning, HMAC-signed upstream request, body-only code reads, mock tokens rejected, shared accounts never claimed, no validation caching. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RrKvdjja8NtzqRKJnX7sA1
…view follow-up) Coordinator review asks on PR #23: - Defense in depth: refuse any validate response without organiser === true; tuvens-api's mint endpoint is the primary gate, but hi.events won't mint a session without the flag. New test asserts refusal without provisioning. - throttle:10,1 on the public exchange endpoint, with a 429 test. - Tightened code read to json('code') only (dropped the form-post fallback). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RrKvdjja8NtzqRKJnX7sA1
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-land of #23, which was accidentally squash-merged into its stacked base branch (
feat/tuvens-account-mapping) instead ofdevelopafter a base-retarget silently failed — that merge never reacheddevelop. This PR carries the identical rebased commits (exchange endpoint + the review-ask follow-up: organiser gate, throttle,json('code')), now correctly targetingdevelop.Coordinator approval of record: see #23 (both asks verified folded in on re-review). No code changes since that approval beyond the mechanical rebase onto post-#22 develop.
🤖 Generated with Claude Code
https://claude.ai/code/session_01RrKvdjja8NtzqRKJnX7sA1