4 Commits

Author	SHA1	Message	Date
Chris Farhood	62056ad86b	Revert "security: enforce JWT audience + require sub in token verification" ... This reverts commit 69fe8a9233.	2026-07-07 18:03:14 -04:00
Chris Farhood	69fe8a9233	security: enforce JWT audience + require sub in token verification ... Closes the audience-binding gap (RFC 9068): tokens minted by the issuer for a different resource are now rejected at /mcp, and subject-less tokens are refused. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 09:30:09 -04:00
Chris Farhood	e50be99374	auth: accept EdDSA tokens + soft audience check (Better Auth compatibility) ... Better Auth signs access tokens with EdDSA (Ed25519), not RS256. Accept EdDSA (+ RS256/ES256), and validate issuer + signature + expiry strictly while checking audience softly — single-resource server behind a dedicated AS with dynamic DCR client ids, so issuer + signature is the trust boundary. Adds an EdDSA test.	2026-07-05 21:55:52 -04:00
Chris Farhood	43bbbb6bbb	test: raise coverage 64% -> 90% with behavior-focused tests + enforced gate ... New suites assert real behavior, not just that code runs: - test_types: workout serialization round-trips (recursive steps, camelCase keys, enum conversion) + __str__ formatting. - test_api_client: request construction (URL/method/auth/body) and the full HTTP status-code -> message mapping. - test_auth: RS256 JWT verification — valid -> AccessToken; expired/wrong-aud/ wrong-issuer/wrong-key/missing-claim -> None; audience slash variants. - test_server_setup: transport selection + start_server dispatch. - test_events / test_activities / test_custom_items: request payloads (create vs update, POST/PUT/DELETE), delete accounting, JSON-content parsing, and error/empty branches. Enforce >=90 via pytest --cov-fail-under=90; CI test job now gates the build. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 18:39:20 -04:00