mika kunsandClaude Opus 4.8
23c3065f20
The Online API now requires the "user" project role (claim urn:zitadel:iam:org:project:roles) instead of an ALLOWED_USER_IDS allowlist. - IOnlineAuthProvider: add GetAccessTokenAsync(forceRefresh) overload - ZitadelAuthProvider: forceRefresh drops the cached token and re-runs the refresh-token grant to mint a fresh, role-bearing token - OnlineInboxApiClient: on 401, force-refresh and retry once; if still 401, throw a clear "missing 'user' role" error - OnlineSyncService: surface the 401 at Error level (no longer silent) - UI: ZitadelTokenInspector decodes the access token after login and warns early when the "user" role is absent (fail-open); shown in settings - docs: online-inbox-api-contract reflects role-based access (no allowlist) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
781 B
C#
25 lines
781 B
C#
using ClaudeDo.Worker.Online.Interfaces;
|
|
|
|
namespace ClaudeDo.Worker.Online;
|
|
|
|
/// <summary>
|
|
/// Simple <see cref="IOnlineAuthProvider"/> that returns a fixed token supplied at construction.
|
|
/// Used as the default DI registration until <c>ZitadelAuthProvider</c> is wired (Phase 2).
|
|
/// Also serves as the test double.
|
|
/// </summary>
|
|
public sealed class StaticTokenAuthProvider : IOnlineAuthProvider
|
|
{
|
|
private readonly string? _token;
|
|
|
|
public StaticTokenAuthProvider(string? token = null)
|
|
{
|
|
_token = token;
|
|
}
|
|
|
|
public Task<string?> GetAccessTokenAsync(CancellationToken ct = default)
|
|
=> Task.FromResult(_token);
|
|
|
|
public Task<string?> GetAccessTokenAsync(bool forceRefresh, CancellationToken ct = default)
|
|
=> Task.FromResult(_token);
|
|
}
|