Integrate auth-go: split-host config + RFC 8693 token exchange#1239

Open

Soph wants to merge 18 commits into

mainfrom

Commits on May 21, 2026

Split auth issuer from data API origin

Soph
and
claude
committed
Add provider routing table for v1/v2 device-flow surfaces

Soph
and
claude
committed
Route auth-token management via configurable path + reject empty bearers

Soph
and
claude
committed
Integrate auth-go library: deviceflow shim + tokenstore.Store + RFC 8693 exchange

Soph
and
claude
committed
Route data-API callers through TokenForResource

Soph
and
claude
committed
Validate received login token before persisting (alg:none, iss, exp)

Soph
and
claude
committed
Thread --insecure-http-auth through to deviceflow.Client

Soph
and
claude
committed
Canonicalise AuthBaseURL to match tokenmanager's internal normalisation

Soph
and
claude
committed
Accept all opaque tokens in validateReceivedToken, reject only alg:none

Soph
and
claude
committed
Omit Authorization header when bearer token is empty

Soph
and
claude
committed
Thread --insecure-http-auth through to the tokenmanager

Soph
and
claude
committed
Address Copilot review: strip path from TokenForResource resources, clamp secondsUntil

Soph
and
claude
committed
Match v2 provider paths to OIDC-standard discovery; route API tokens to data host

Soph
and
claude
committed

Commits on May 22, 2026

Open verification_uri_complete on login when the AS supplies one

Soph
and
claude
committed

Commits on May 24, 2026

Merge origin/main into soph/auth-go; bump auth-go v0.1.1-... → v0.3.3
khaong
committed

Commits on May 25, 2026