6 Commits (06ea3906eb987783bb78829cd49124fecb879dc8)

Author	SHA1	Message	Date
Micke Nordin	41cc0a4ed6	chore(http-sig): Simplify implementation ... Signed-off-by: Micke Nordin <kano@sunet.se>	2 weeks ago
Micke Nordin	dae8a36460	fix(ocm): treat RFC 9421 keyid as opaque, verify by sender origin ... RFC 7517 §4.5 leaves the keyid structure unspecified, so the receiver must not parse it. The signer origin now comes from the trusted OCM share/sender identity; the JWK Set is resolved against that origin and the keyid is matched opaquely to the JWKS kid. Aligns with the OCM verification procedure and fixes the origin-mismatch / flaky-kid failures in the two-port integration rig. Reverts the per-request host-based kid back to a stable persisted kid, drops keyid->host parsing, threads a sender-origin parameter through verification, and resolves that origin in every OCM inbound entry point (notifications, shares, token exchange, OCM requests) and the federation rate limiter. Cavage is unchanged. Assisted-by: ClaudeCode:glm-5.2 Signed-off-by: Micke Nordin <kano@sunet.se>	2 weeks ago
Joas Schilling	f4f93ed281	fix(ocm): Correctly track OCM requests ... Signed-off-by: Joas Schilling <coding@schilljs.com>	4 months ago
Maxence Lange	42d745e17b	fix(ocm): empty response ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	7 months ago
Maxence Lange	327d691c23	feat(signed-request): moving out of unstable ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	7 months ago
Maxence Lange	6af64a5495	feat(ocm): event on ocm discovery and ocm request ... Signed-off-by: Maxence Lange <maxence@artificial-owl.com>	8 months ago