Marc-André Bombeck ada147522f test(auth): cover the native OIDC SSO handoff ...

Unit-test the handoff library (mint stores only the hash + binds the
challenge + 90s TTL; consume covers not-found / replay-with-revoke /
expiry-burn / PKCE-burn / atomic consume / lost-race), the
token-exchange route (rate limit, transport gate, one identical generic
401 across every invalid-code class, success with issued-hash stamp +
audit, and OIDC_ONLY does not block it), the callback native branches
(handoff mint + scheme redirect with no session, MFA ticket on the
scheme with no session/cookie, post-identity + IdP errors to the
scheme, CSRF web-fallback), the login native-param handling, and the
by-hash refresh-token revoke used for replay containment.

2026-07-18 16:50:56 +02:00

..

__tests__

test(auth): cover the native OIDC SSO handoff

2026-07-18 16:50:56 +02:00

route.ts

feat(auth): native OIDC SSO session handoff for the iOS client

2026-07-18 16:50:56 +02:00