jubnl 20bf9c2312 security: close SEC-H4/H6 gaps from second-pass review ... - SEC-H6: remove conditional audience check in mcp/index.ts — audience is now always enforced against the mcpResource URL. Add migration to revoke pre-existing oauth_tokens with audience=NULL so dead rows don't linger. - SEC-H4: validate doc.issuer against config.issuer inside discover() to prevent a MITM'd discovery doc from supplying a crafted expected issuer. verifyIdToken caller now passes config.issuer as ground truth, not doc.issuer. - tests: cover three new OIDC callback failure paths (no_id_token, id_token_invalid, subject_mismatch) and two idempotency caps (key length >128 chars returns 400, body >256 KiB skips caching).		2026-04-20 21:35:30 +02:00
..
auth.test.ts	test: expand test suite to 87.3% backend coverage	2026-04-06 20:08:30 +02:00
idempotency.test.ts	security: close SEC-H4/H6 gaps from second-pass review	2026-04-20 21:35:30 +02:00
mfaPolicy.test.ts	Add comprehensive backend test suite (#339)	2026-04-03 13:17:53 +02:00
tripAccess.test.ts	test: expand test suite to 87.3% backend coverage	2026-04-06 20:08:30 +02:00
validate.test.ts	Add comprehensive backend test suite (#339)	2026-04-03 13:17:53 +02:00