releases/ClaudeDo
2
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases 12 Wiki Activity

feat(worker): real ZitadelAuthProvider (refresh-token grant, auth-code+PKCE)

Browse Source 
Headless refresh-token -> access-token exchange via OIDC discovery + token
endpoint. Cached to expiry (60s margin), thread-safe, persists rotated refresh
tokens, graceful null on invalid_grant/network errors. Wired into DI when
online_inbox is enabled. Interactive PKCE login (UI) still pending the
registered redirect URI. 7 tests, stubbed HttpMessageHandler.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
mika kuns
2026-06-10 10:08:33 +02:00
parent 96da9fbae5
commit 619bc0c38d
3 changed files with 407 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/ClaudeDo.Worker/Program.cs
View File

@@ -156,9 +156,10 @@ if (cfg.OnlineInbox.Enabled)
{
OnlineInboxApiClient.ValidateBaseUrl(cfg.OnlineInbox.ApiBaseUrl);
builder.Services.AddSingleton(cfg.OnlineInbox);
builder.Services.AddSingleton<IOnlineAuthProvider, StaticTokenAuthProvider>();
builder.Services.AddHttpClient();
#pragma warning disable CA1416 // ClaudeDo.Worker is Windows-only; DPAPI is fine here.
builder.Services.AddSingleton<OnlineTokenStore>();
builder.Services.AddSingleton<IOnlineAuthProvider, ZitadelAuthProvider>();
#pragma warning restore CA1416
builder.Services.AddHttpClient<IOnlineInboxApi, OnlineInboxApiClient>(client =>
{