agent 4.0.0 / resource 2.5.0 / fetch 4.0.0: presented_token, clock_skew, mockin 3.0.0 - #27
Merged
Merged
Conversation
…resented_token, clock_skew, mockin 3.0.0 AAuth -11 issue #152: the auth token request carries presented_token — the token the agent presented to the resource, which the resource token's presented_jti names. agent 4.0.0 (breaking: exchangeToken requires presentedToken) - exchangeToken sends presented_token, checks presented_jti names it before the round trip (§Resource Token Verification, agent side) - TokenExchangeError.retryAfterSeconds on clock_skew, from the server's Date header: wait, do not refresh - createAAuthFetch tracks what it presented: the person token, or on a step-up the cached auth token that drew requirement=auth-token; a 401 clock_skew on a cached token is returned unchanged and the token kept; an auth-token challenge on a request that presented nothing is an error resource 2.5.0 - createResourceToken takes presentedToken: a VerifiedPersonToken, a VerifiedAuthToken (step-up: ps from the auth token, presented_jti its jti) or a reference; personToken kept as a deprecated alias fetch 4.0.0 - authorize gets a person token first when a person server is configured and presents it to the resource; two-party (no PS) unchanged e2e: @hellocoop/mockin ^3.0.0 (verifies presented_token; strict exp; clock_skew); the fake resource names the auth token on a per-call challenge and keeps no person-token record. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEeAq61zr1oVg5FAFf3JTH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AAuth -11 issue #152 (dickhardt/AAuth#153) on the agent side, plus clock_skew (§Expiry and the Refresh Margin).
exchangeTokenrequirespresentedTokenand sendspresented_token; checks the resource token'spresented_jtinames it before the round trip;TokenExchangeError.retryAfterSecondsonclock_skew(wait, do not refresh).createAAuthFetchpresents the person token, or on a step-up the cached auth token that drew the challenge; returns aclock_skew401 unchanged and keeps its cached token.createResourceToken({ presentedToken })accepts a verified person token, a verified auth token (step-up), or a reference;personTokenstays as a deprecated alias.authorizeobtains a person token first (when a person server is configured) and presents it; two-party stays on the agent token.@aauth/agent^4.0.0.@hellocoop/mockin3.0.0; the fake resource names the auth token on a per-call challenge and keeps no person-token record.770 tests passing (59 e2e against mockin). Lockfile: platform nodes intact.
🤖 Generated with Claude Code
https://claude.ai/code/session_01FEeAq61zr1oVg5FAFf3JTH