4 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	70206d6033	chore(deps): matrix-js-sdk 41.7 -> 44.0 (#201) ... Picks up three releases of MatrixRTC / delayed-event fixes and matrix-sdk-crypto-wasm 18.3.1 -> 18.9.0. SDK 43 moved OAuth (MSC3861) into the SDK and dropped oidc-client-ts, so the native-OAuth sign-in is ported: - login discovers the auth server via /auth_metadata, registers with OAuth2.registerClient, and keeps the PKCE verifier + device in its own sessionStorage entry keyed by `state` (single use; CSRF check); - refresh is done by the SDK (oauthClientId + onTokenRefresh); the #16 cross-tab protection is kept by a narrow guard on refresh-token grants (the SDK calls the global fetch for OAuth, not fetchFn), which serialises them with a Web Lock and adopts a sibling tab's tokens; - logout and forced logout revoke via mx.logout() (the SDK revokes at the auth server for OAuth sessions); - the callback page parsed its params on every render, re-running the single-use code exchange in a loop; parsed once now. Also: notification_type is deprecated in MSC4075 (ring in DMs, notify elsewhere when omitted), _onRTCSessionMemberUpdate -> ensureRecalculateSessionMembers, precache limit 6 -> 10 MB for the 7.8 MB crypto wasm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-24 00:32:13 -04:00
jaredandClaude Opus 5	2ca59be9fc	fix(auth): OIDC callback evicts a cached client id the provider rejects ... The redirect back with ?error=invalid_client is the only place a stale dynamic client id is ever rejected; the callback now resolves the issuer from the SDK's stored mx_oidc_<state> entry and invalidates the cache so the next attempt re-registers. Degrades to a no-op if the state entry is gone. Unit-tested. Fixes #102 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-13 00:56:22 -04:00
jaredandClaude Opus 5	8210ee7046	fix(auth): only drop the cached OIDC client id when the client is rejected ... A transient network/discovery failure invalidated the cached dynamic client and registered a fresh one on every retry. Invalidate only on invalid_client / unauthorized_client or a 400/401 from the provider. Unit-tested. Fixes #67 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-12 19:46:05 -04:00
jaredandClaude Opus 4.8	a50d3e7ca7	feat(auth): OIDC phase 2 — login initiation (discover/register/authorize) ... - oidc/oidcState.ts (pure, +3 tests): dynamic-registration cache (by issuer + redirectUri, corrupt-tolerant) and parseOidcCallbackParams (success/error/invalid). - oidc/oidcLoginUtil.ts: getOrRegisterClientId (cache + registerOidcClient) and startOidcLogin (discoverAndValidateOIDCIssuerWellKnown -> generateOidcAuthorization Url -> redirect; invalidates the cache on failure). redirectUri is the deterministic getOidcCallbackUrl(), and the SDK returns clientId/issuer on callback, so no hand-rolled transient state is needed. - login/OidcLogin.tsx: native-OIDC button mirroring SSOLogin + TokenLogin async/error. - login/Login.tsx: issuer-gated — when discovery advertises an issuer, render OidcLogin and suppress password/legacy-SSO; non-OIDC servers unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 16:01:35 -04:00