holden093 c87bcfb8cb fix(oidc): address remaining review items — issuer fail-closed, multi-audience azp, OIDC 2FA guards ... 1. Discovery issuer mismatch now raises OidcError instead of logging a warning (OIDC Discovery §1.1 requires mismatch abort). 2. Multi-audience ID tokens without azp are now rejected (OIDC Core §2 requires azp when aud has multiple values). 3. /change-password, /2fa/setup, /2fa/confirm, and /2fa/disable now reject OIDC users with a clear message. The frontend already hides these cards, but the backend must also enforce the policy. 113 passing (76 OIDC + 37 regression), 0 failures.		2026-07-25 18:32:56 +02:00
..
__init__.py	Odysseus v1.0	2026-05-31 23:58:26 +09:00
atomic_io.py	Reject non-string atomic text writes (#1819)	2026-06-29 14:36:21 +01:00
auth.py	fix(oidc): address RaresKeY review — bootstrap gating and UserInfo sub protection	2026-07-25 18:32:56 +02:00
constants.py	refactor(constants): single source of truth for data dir (#3368)	2026-06-08 09:58:52 +02:00
database.py	fix(db): restrict data/app.db to 0600 (#4420)	2026-07-11 21:15:49 +02:00
exceptions.py	refactor(exceptions): dedupe src/exceptions via core re-export (#4785)	2026-06-24 16:50:07 +02:00
log_safety.py	fix(security): redact credential-bearing URLs and PII from logs (#4750)	2026-06-22 23:12:39 +02:00
middleware.py	Show thumbnails on past research cards	2026-06-30 08:00:01 +00:00
models.py	fix: session context drifting — messages leaking between chats (#135) (#267)	2026-06-09 14:12:52 +01:00
oidc.py	fix(oidc): address remaining review items — issuer fail-closed, multi-audience azp, OIDC 2FA guards	2026-07-25 18:32:56 +02:00
platform_compat.py	fix(platform): read proc version with utf-8	2026-06-11 21:58:22 +01:00
session_manager.py	Merge verified Odysseus fixes	2026-07-23 14:49:02 +00:00