Andy Dixon
35d58ff07b
docs: add CSV import limit guidance for bulk admin flows
...
Document operational expectations for CSV file-size and row-count limits during provider bulk-user import automation.
2026-02-26 13:17:28 +00:00
Andy Dixon
464524da27
docs: note serialized decision behavior for approval actions
...
Clarify that approve/reject/cancel decisions for a single approval request should be treated as serialized and not submitted in parallel.
2026-02-26 13:16:32 +00:00
Andy Dixon
8bb3c1ce12
docs: note JWT revocation-aware userinfo behavior
...
Update integration guidance that revoked JWT access tokens are now rejected on provider userinfo before natural expiry.
2026-02-26 13:00:51 +00:00
Andy Dixon
bbcada1317
docs: clarify idempotent retry expectations for approval flows
...
Document serialized approval execution expectations and recommend bounded idempotent client retries for admin mutation workflows.
2026-02-26 12:58:50 +00:00
Andy Dixon
878e2b98e6
docs: add reverse-proxy IP header hardening guidance
...
Document strict trusted-proxy configuration requirements to avoid spoofed client IP forwarding affecting abuse controls.
2026-02-26 12:42:10 +00:00
Andy Dixon
6cc2ddabd0
docs: require non-URL handling for enrollment links
...
Clarify that enrollment URLs are sensitive bearer material and must not be transported in redirect query strings or logs.
2026-02-26 12:40:33 +00:00
Andy Dixon
fb60a1eccb
docs: document introspection active=false on disabled subjects
...
Clarify SDK integration guidance that provider introspection can return active=false when user/project/client is disabled after token issuance.
2026-02-26 12:38:45 +00:00
Andy Dixon
ebea82f63d
docs: add CSV export formula-injection handling guidance
...
Document that provider CSV exports should be handled with formula-injection safety when opened in spreadsheet tooling.
2026-02-26 12:35:02 +00:00
Andy Dixon
3d3493e546
docs: require POST+CSRF for admin enrollment export calls
...
Document provider hardening change: enrollment URL export is state-changing and must be invoked with POST plus CSRF token, not GET links.
2026-02-26 12:33:51 +00:00
Andy Dixon
822b9b93c5
docs: document cryptbin unwrap key proof requirement
...
Update SDK security guidance/examples to note that provider cryptbin unwrap calls must include key_b64url and now fail with 403 Forbidden on key mismatch.
2026-02-26 12:31:11 +00:00
Andy Dixon
f9323110ce
docs: prohibit URL query transport of secrets and tokens
...
Update SDK security guidance to explicitly forbid placing client secrets or bearer tokens in URL query strings, matching provider-side hardening against secret leakage.
2026-02-26 12:02:21 +00:00
Andy Dixon
cb0bd43d04
docs: clarify end-user integrations should use OAuth/portal endpoints
...
Add guidance that admin authentication endpoints are scope-restricted and not intended for end-user SDK integrations.
2026-02-26 11:52:41 +00:00
Andy Dixon
066a0b8fb7
docs: require HTTPS redirect URIs except localhost loopback dev
...
Align SDK integration guidance with provider redirect URI hardening: use HTTPS callback URLs in production and limit HTTP callbacks to localhost loopback during development/testing.
2026-02-26 11:46:31 +00:00
Andy Dixon
d8a28dea12
docs: document consent-time access_denied from provider revalidation
...
Clarify that providers may return access_denied at callback time even after consent UI is shown, when membership/tenant scope changes before consent submission. This aligns integration guidance with current provider-side security enforcement.
2026-02-26 11:38:13 +00:00
Andy Dixon
f529714f45
docs: handle OAuth callback access_denied outcomes from stricter provider authz
...
Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
2026-02-26 11:36:17 +00:00
Andy Dixon
6ddbcaec70
docs: add OIDC nonce guidance and callback error handling
2026-02-26 11:11:47 +00:00
Andy Dixon
3ff5b7aa26
Security hardening: enforce secure URLs and transport safeguards
2026-02-26 09:10:09 +00:00
Andy Dixon
94c85fc8d5
Release 1.0.1: normalized userinfo and callback helper
2026-02-26 09:07:11 +00:00
Andy Dixon
1c7b7b6717
Update package name in installation instructions
2026-02-23 09:35:39 +00:00
Andy Dixon
1ed5bd6bd3
Changed base blackwall URL
2026-02-13 13:51:59 +00:00
Andy Dixon
bbbc2dffae
Update README.md
2026-02-10 09:21:19 +00:00
Andy Dixon
57637840a5
Initial Commit
2026-02-10 09:17:22 +00:00
Andy Dixon
Andy Dixon