Real auth: /v1/oauth/{state,exchange,handoff/{id}} with PKCE-S256, S2S guard, atomic getDel#15

Merged

rainxchzed merged 8 commits into

mainfrom

feat/oauth-web-flow

May 15, 2026

Commits on May 15, 2026

Add oauth_ephemeral table (V16) for 60s-TTL state and handoff storage
rainxchzed
committed
Add OAuthEphemeralStore with atomic GETDEL semantics on Postgres
rainxchzed
committed
Add OAuthExchangeService and OAuthCleanupWorker
rainxchzed
committed
Add /v1/oauth/{state,exchange,handoff/{id}} routes with PKCE-S256 and S2S auth
rainxchzed
committed
Wire OAuth routes, rate limits, required env vars, and CLAUDE.md docs
rainxchzed
committed
Rename GITHUB_OAUTH_CLIENT_{ID,SECRET} to OAUTH_CLIENT_{ID,SECRET}, narrow ALLOWED_HOSTS default, document the deep-link contract
rainxchzed
committed
Security review fixes: atomic getDel in /exchange, always-burn state, GitHub error whitelist, MessageDigest.isEqual, 401-on-misconfig, no-store on every handoff response, X-Oauth-Service-Token in S…
rainxchzed
committed
Architecture review fixes: require ALLOWED_HOSTS and WEB_CALLBACK_URL in prod, OAUTH_CLEANUP_DISABLED kill switch, drop unused Exposed OAuthEphemeral declaration
rainxchzed
committed