mirror of
https://github.com/penpot/penpot.git
synced 2026-11-15 06:31:02 +00:00
036a2c0d22
Replace the OIDC-local build-public-uri helper with the canonical cf/get-public-uri so every backend link shares one builder, and drop the test that only covered the duplicate. Assert the OIDC token-exchange redirect_uri under a trusted origin by driving the callback with the HTTP client mocked instead of get-info; the test fails if the exchange hardcodes the canonical base. Document that removing an origin does not invalidate already-signed OIDC states (up to four hours) and that MCP OAuth follows the stamped origin the same way. Bring MCP OAuth into scope: wrap its routes with wrap-trusted-origin, stage the stamped origin in the Redis request record at authorize time, and re-apply it in decision so issuer, resource, the approval redirect and the code-exchange iss agree on one base. Unlisted origins and requests without Origin keep the canonical base. Add a tabulated trusted/untrusted end-to-end test over the real router. AI-assisted-by: muse-spark-1.3-contributor