Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds LocalTokenProvider login/MFA and an in-memory session scoped to repository, issuer and user. The transport refreshes proactively, retries one 401 for replayable requests, rejects cross-repository use and clears sessions on logout without API-key/basic fallback. Human passwords are never stored in options.
Adds an extensible provider registry with IdentityServer as the default, token-cache isolation by provider and identity, JWT-exp-based cache limits and fresh token lookup on every ServerContextFactory call. API keys and supplied bearer tokens bypass provider acquisition. SNAuth-issued bearer tokens remain supported; local user credentials are not treated as an unattended client-credentials grant.
Validation: 467 unit tests passed, including eight new session/cache/factory/DI transport regressions. Tests use controlled HTTP responses, not a live repository. See docs/local-authentication.md for usage and the 16 MiB replay limit.
Built in an isolated worktree; pre-existing changes in the original checkout are excluded.
Companion changes: SenseNet/sensenet and SenseNet/sn-client, both on codex/sb-167-internal-auth. Add their PR links after creation.