chore: upgrade Go to 1.24.6 - #7
Merged
Merged
Conversation
This change upgrades the Go version used in the project to 1.24.6. It includes fixes to vulnerabilities in os/exec and database/sql.
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
ryan-timothy-albert
approved these changes
Aug 6, 2025
qstearns
added a commit
that referenced
this pull request
May 4, 2026
Lands the dev-idp's oauth2 mode (idp-design.md §7.4) — an OAuth 2.0 authorization server backing legacy remote_session_issuer migration tests (milestones #7 / #8). Differences from oauth2-1: - No /register endpoint (DCR is not part of OAuth 2.0). - /authorize accepts requests without code_challenge — the legacy no-PKCE path. When code_challenge IS supplied, only S256 is honored (`plain` rejected; "string equality" PKCE adds no security value). The challenge presence is recorded on the auth_codes row so /token knows which path to follow. - /token authorization_code grant: PKCE verifier validated only when the auth code was minted with a challenge. - /token refresh_token grant: does NOT rotate the refresh token. A new access token is issued; the same refresh token is returned. Tests that need rotation behavior should target oauth2-1. - Discovery doc omits registration_endpoint but still advertises code_challenge_methods_supported=["S256"] — supported, just not required. Tests cover: discovery doc shape (incl. asserting no registration_endpoint), /register returning 404 (mux unaware), and /authorize rejecting non-S256 challenges. The "PKCE-optional happy path" requires a live DB so it lives in the integration-test ticket. Note: this is structurally a near-clone of oauth21/handler.go with the 4 protocol differences applied. Kept as parallel packages rather than extracting a shared OAuth helper module — two near-clones is cheaper than the abstraction it would justify, and the differences are business logic per the OAuth version. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
qstearns
added a commit
that referenced
this pull request
May 5, 2026
Stand up server/internal/usersessions/ with stubs for all four management API services from spike §6.1: userSessionIssuers, userSessionClients, userSessionConsents, userSessions. Goa designs are split across four server/design/usersession*/ packages; one Go Service struct implements all four generated interfaces and exposes per-service Attach* helpers wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #4-#7. Adds URN types for each resource, the sqlc.yaml stanza, and the SDK regeneration that surfaces the new endpoints.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Stand up server/internal/usersessions/ with stubs for all four management API services from spike §6.1: userSessionIssuers, userSessionClients, userSessionConsents, userSessions. Goa designs are split across four server/design/usersession*/ packages; one Go Service struct implements all four generated interfaces and exposes per-service Attach* helpers wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #4-#7. Adds URN types for each resource, the sqlc.yaml stanza, and the SDK regeneration that surfaces the new endpoints.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Stand up server/internal/usersessions/ with stubs for all four management API services from spike §6.1: userSessionIssuers, userSessionClients, userSessionConsents, userSessions. Goa designs are split across four server/design/usersession*/ packages; one Go Service struct implements all four generated interfaces and exposes per-service Attach* helpers wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #4-#7. Adds URN types for each resource, the sqlc.yaml stanza, and the SDK regeneration that surfaces the new endpoints.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Stand up server/internal/usersessions/ with stubs for all four management API services from spike §6.1: userSessionIssuers, userSessionClients, userSessionConsents, userSessions. Goa designs are split across four server/design/usersession*/ packages; one Go Service struct implements all four generated interfaces and exposes per-service Attach* helpers wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #4-#7. Adds URN types for each resource, the sqlc.yaml stanza, and the SDK regeneration that surfaces the new endpoints.
qstearns
added a commit
that referenced
this pull request
May 6, 2026
Stand up server/internal/usersessions/ with stubs for all four management API services from spike §6.1: userSessionIssuers, userSessionClients, userSessionConsents, userSessions. Goa designs are split across four server/design/usersession*/ packages; one Go Service struct implements all four generated interfaces and exposes per-service Attach* helpers wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #4-#7. Adds URN types for each resource, the sqlc.yaml stanza, and the SDK regeneration that surfaces the new endpoints.
qstearns
added a commit
that referenced
this pull request
May 7, 2026
Stand up server/internal/usersessions/ with stubs for all four management API services from spike §6.1: userSessionIssuers, userSessionClients, userSessionConsents, userSessions. Goa designs are split across four server/design/usersession*/ packages; one Go Service struct implements all four generated interfaces and exposes per-service Attach* helpers wired in start.go. All handler bodies return oops.CodeNotImplemented. Audit, RBAC, and real SQLc queries land in tickets #4-#7. Adds URN types for each resource, the sqlc.yaml stanza, and the SDK regeneration that surfaces the new endpoints.
qstearns
added a commit
that referenced
this pull request
May 12, 2026
…dings Security: - Sec #1: Auth-code redemption is now atomic via Redis GETDEL (new Cache.GetAndDelete). Two clients racing on the same code can't both win. - Sec #14: Consent-state consumption uses the same GETDEL primitive, preventing parallel POSTs from minting multiple grants per /authorize. - Sec #13: ValidateBearer fails closed on revocation-cache errors (Redis outage → tokens reject, not admit). - Sec #4: /revoke verifies the presented token belongs to the authenticated client (RFC 7009 §2.1). Ownership mismatches look like the "unknown token" silent-no-op per §2.2. New GetUserSessionByJTI and GetUserSessionByRefreshTokenHash peek queries support this. - Sec #9: JWT audience is now urn.NewToolset(toolset.ID) — globally unique even when slugs collide across projects. No cross-project token replay. - Sec #11: JWT iss claim honours custom domains (matches the AS metadata document's issuer). Correctness: - Bug #2: Access-token lifetime is hardcoded (1h). issuer.SessionDuration is now the refresh-token (i.e. total session) lifetime — the value the IDP-driven session window was meant to control. - Bug #5: HandleIDPCallback forwards IDP error responses back to the MCP client's redirect_uri instead of swallowing them as a generic 400. - Bug #6: Consent POST refuses to mint an anonymous session for a private toolset — IDP authentication is required first. - Bug #8: Consent approve path requires action=approve explicitly. Missing or unknown values 400, not fail-open into the approval branch. - Bug #10: HandleToken now calls requireUserSessionIssuer like the other authn-dance handlers. - Bug #15: Consent POST → GET redirects use 303 See Other (was 302 Found, which leaves the verb implementation-defined). Hardening: - Hard #3: isUniqueViolation uses errors.As + *pgconn.PgError.Code instead of strings.Contains on the error message. - Hard #7: Migrate the remaining "jwt-signing-key" literal callsites (chatsessions/assistanttokens/assets) to usersessions.JWTSigningKeyFlag.
This was referenced Jun 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change upgrades the Go version used in the project to 1.24.6. It includes fixes to vulnerabilities in os/exec and database/sql.