6 Commits (7dd9f407990a67f0ea8bf1fca03d2a7da8a093e1)

Author	SHA1	Message	Date
Micke Nordin	41cc0a4ed6	chore(http-sig): Simplify implementation ... Signed-off-by: Micke Nordin <kano@sunet.se>	2 weeks ago
Micke Nordin	dae8a36460	fix(ocm): treat RFC 9421 keyid as opaque, verify by sender origin ... RFC 7517 §4.5 leaves the keyid structure unspecified, so the receiver must not parse it. The signer origin now comes from the trusted OCM share/sender identity; the JWK Set is resolved against that origin and the keyid is matched opaquely to the JWKS kid. Aligns with the OCM verification procedure and fixes the origin-mismatch / flaky-kid failures in the two-port integration rig. Reverts the per-request host-based kid back to a stable persisted kid, drops keyid->host parsing, threads a sender-origin parameter through verification, and resolves that origin in every OCM inbound entry point (notifications, shares, token exchange, OCM requests) and the federation rate limiter. Cavage is unchanged. Assisted-by: ClaudeCode:glm-5.2 Signed-off-by: Micke Nordin <kano@sunet.se>	2 weeks ago
Micke Nordin	99ac009a12	fix(cloud_federation_api): allow multiple access tokens per refresh token ... A refresh token may back several concurrent access tokens. E.g. in a multi protocol share for a webapp the webdav mount and the webapp launcher exchange the same secret, so the exchange must not assume a single mapping. Drop the revoke-previous step and the findByRefreshToken (findEntity) lookup, which threw MultipleObjectsReturnedException once more than one access token existed. Expiry and unshare cleanup revoke the tokens instead. Assisted-by: ClaudeCode:claude-fable-5 Signed-off-by: Micke Nordin <kano@sunet.se>	1 month ago
Antoon P.	5cbdfac055	fix(ocm): Move invite-accepted capability and implementation to contacts app. ... Signed-off-by: Antoon P. <antoon.prins@surf.nl>	1 month ago
Enrique Pérez Arnaud	789ff6a8a3	feat(cloud_federation_api): add token exchange endpoint issuing JWT access tokens ... Co-authored-by: Micke Nordin <kano@sunet.se> Signed-off-by: Micke Nordin <kano@sunet.se> Signed-off-by: Enrique Pérez Arnaud <enrique@cazalla.net>	2 months ago