3ngram 1.2.2

3ngram v1.2.2

Patch release: OAuth client resolution. A deployment whose DNS returns
IPv4-mapped answers could not authorize any Client ID Metadata Document (CIMD)
client at all, and the /oauth/authorize rejection that resulted was invisible
in logs. Both are fixed.

Changes

• CIMD fetches no longer fail closed on IPv4-mapped DNS answers. The
  SSRF guard's address-family agreement check compared the resolver-reported
  family against ipaddr.process(), which unmaps ::ffff:a.b.c.d to its
  IPv4 form. A resolver reports that answer as family 6, so the unmapped kind
  (ipv4 → 4) disagreed and a perfectly self-consistent answer was treated as
  forged: every CIMD document fetch threw unsafe_address before a socket was
  opened, surfacing to the client as a bare 400 invalid_client. The check now
  uses ipaddr.parse(), which preserves the wire form.

  The security boundary is unchanged. isPublicClientMetadataAddress()
  still classifies via process(), so a mapped loopback, private, or otherwise
  non-public answer (::ffff:127.0.0.1) is still rejected. Both directions are
  pinned by tests.

• /oauth/authorize now records why it rejected a request. One structured,
  content-free line per rejected request (oauth: authorize endpoint) carrying
  a hashed client_id_prefix and a closed-set reason: not_registered,
  metadata_* for each CIMD failure class, metadata_not_materialized,
  unsupported_grant_type, or redirect_uri_mismatch. Previously all of these
  returned an identical bare 400 invalid_client with nothing written
  anywhere, so a stale registration and a metadata document that never loaded
  were indistinguishable in production logs.

  The response is unchanged — still a uniform invalid_client, so there is no
  enumeration oracle. The reason is diagnostic only and never leaves the log
  line, and the raw client_id is never written (CIMD identifiers are URLs
  that may carry a query component — hard rule 6).

Upgrading

No configuration or migration changes. Operators running a CIMD client against
a resolver that returns IPv4-mapped addresses will see authorization start
working; everyone else sees only the new rejection log line.

Library versions

@3ngram/core 0.8.0 (new optional resolveOAuthClient failure seam;
two-argument callers are unaffected). @3ngram/db 0.7.0, @3ngram/schema
0.6.0, @3ngram/config 0.2.3 — unchanged.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:7eef573b1ffc8f33b61dbd4884187060302f8e0f11c00175297ea906ec7670f3