mika kuns 619bc0c38d feat(worker): real ZitadelAuthProvider (refresh-token grant, auth-code+PKCE) ...

Headless refresh-token -> access-token exchange via OIDC discovery + token
endpoint. Cached to expiry (60s margin), thread-safe, persists rotated refresh
tokens, graceful null on invalid_grant/network errors. Wired into DI when
online_inbox is enabled. Interactive PKCE login (UI) still pending the
registered redirect URI. 7 tests, stubbed HttpMessageHandler.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-10 10:08:33 +02:00

8.9 KiB

Raw Blame History

View Raw