KRATOSandKRATOS ce4a996ffa fix(oauth): validate discovered endpoints before merge/use (#511) (#739) ...

Discovery metadata was merged without the https/loopback endpoint rule that
configured endpoints already pass, letting a malicious issuer downgrade the
authorization/token/device/registration endpoint after config validation.

- Add exported ValidateEndpointURL as the single endpoint-safety rule;
  validateTokenEndpoint now delegates to it.
- Backstop in BuildAuthorizationURL (the choke point both the provider and MCP
  flows build their browser URL through).
- Validate each discovered endpoint before merge in the provider resolveEndpoints
  and validate resolved MCP metadata in both branches; fail closed on insecure.

Co-authored-by: KRATOS <[email protected]>

2026-07-19 09:56:32 +05:30

..

device_test.go

feat(oauth): reusable provider OAuth engine + zero auth CLI (#210)

2026-06-15 18:47:43 +05:30

device.go

feat(oauth): reusable provider OAuth engine + zero auth CLI (#210)

2026-06-15 18:47:43 +05:30

discovery.go

feat(oauth): reusable provider OAuth engine + zero auth CLI (#210)

2026-06-15 18:47:43 +05:30

encrypt_test.go

Align permission prompt rendering (#246)

2026-06-18 16:53:20 +05:30

encrypt.go

fix: address bugs found in a multi-agent codebase audit (#481)

2026-07-06 18:48:28 +08:00

flow_test.go

fix(oauth): validate discovered endpoints before merge/use (#511) (#739)

2026-07-19 09:56:32 +05:30

flow.go

fix(oauth): validate discovered endpoints before merge/use (#511) (#739)

2026-07-19 09:56:32 +05:30

lock.go

fix(lock): prevent POSIX lock file overwrite and leak on Windows/Unix (#628)

2026-07-13 21:45:08 +08:00

loopback_test.go

fix(oauth): make ChatGPT (Codex) login work end-to-end (#264)

2026-06-20 23:00:01 +05:30

loopback.go

fix(oauth): make ChatGPT (Codex) login work end-to-end (#264)

2026-06-20 23:00:01 +05:30

manager_test.go

fix(oauth): validate discovered endpoints before merge/use (#511) (#739)

2026-07-19 09:56:32 +05:30

manager.go

fix(oauth): validate discovered endpoints before merge/use (#511) (#739)

2026-07-19 09:56:32 +05:30

oauth.go

feat(oauth): Hugging Face + ChatGPT Codex as first-class built-in OAuth presets (#245)

2026-06-19 07:23:53 +05:30

pkce.go

feat(oauth): reusable provider OAuth engine + zero auth CLI (#210)

2026-06-15 18:47:43 +05:30

presets_test.go

fix(oauth): make xAI / Hugging Face OAuth actually launch from the wizard (#355)

2026-07-01 18:37:56 +05:30

presets.go

fix(oauth): make xAI / Hugging Face OAuth actually launch from the wizard (#355)

2026-07-01 18:37:56 +05:30

providers_test.go

feat(oauth): reusable provider OAuth engine + zero auth CLI (#210)

2026-06-15 18:47:43 +05:30

providers.go

OAuth / account login for providers (OpenRouter, xAI) + subscription-proxy support (#217)

2026-06-16 15:33:36 +05:30

refresh_singleflight_test.go

fix five concurrency/leak bugs (swarm, specialist, oauth, mcp, cron) (#265)

2026-06-20 10:39:55 +05:30

scheduler_test.go

Audit tail: remaining medium/low correctness fixes (CLI, config, OAuth, tools, LSP, TUI) (#275)

2026-06-20 22:21:48 +05:30

scheduler.go

Audit tail: remaining medium/low correctness fixes (CLI, config, OAuth, tools, LSP, TUI) (#275)

2026-06-20 22:21:48 +05:30

secret_access_other.go

Add request permissions flow (#248)

2026-06-18 20:00:35 +05:30

secret_access_windows.go

Add request permissions flow (#248)

2026-06-18 20:00:35 +05:30

store_keyring_test.go

Audit backlog: tui mouse API, notify webhook, swarm scheduling, daemon-remote bundles, MCP/oauth store unification, OS keyring, dead-code prune (#216)

2026-06-16 14:48:12 +05:30

store_test.go

feat(providers): OAuth login profiles and list-first /provider manager (#560)

2026-07-07 10:34:59 +08:00

store.go

feat(providers): OAuth login profiles and list-first /provider manager (#560)

2026-07-07 10:34:59 +08:00