mirror of
https://github.com/tiennm99/DocsGPT.git
synced 2026-10-23 18:16:58 +00:00
Alex
321d88d5be
Follow-up to the OIDC security hardening, from a max-effort re-review: - Refresh now re-checks the denylist immediately before minting, against the (possibly remapped) identity but anchored on the original session `iat` — so a back-channel logout / SCIM deny that lands during the IdP grant, or one targeting the refreshed sub/sid, still blocks renewal instead of being escaped by the renewed token's fresh iat. Completes the watermark revocation fix. - SCIM PUT `userName` immutability check is now case-insensitive, matching the case-insensitive list/create — a differently-cased userName echo no longer 400s "userName is immutable" and blocks deprovision. Completes the SCIM case-insensitivity fix. - Drop the unconditional state-cookie deletion on every callback exit: it let one tab's callback clear another in-flight tab's cookie, breaking concurrent logins. The cookie self-expires (max_age) and the Redis state is single-use, so the delete wasn't needed. Tests added for the refresh revocation re-check and the case-insensitive PUT.