- Verschickt
- 15. November 2026 um 12:55 UTC
- Autor
- Kamo
- Commit
- cc87602
- /api/security/oidc/register (RFC 7591): 404 unless the org's dcrMode is APPROVAL / AUTO_PUBLIC; PENDING + one approval notification, except a public loopback/https app in AUTO_PUBLIC; per-IP and per-org limits; audited - Connected Apps settings dcrMode + registrationUrl; discovery registration_endpoint only while on, API scopes in scopes_supported - oauthserver/scopes/ApiScopes: <area>.read|write -> RoleRightTypes; public /api/security/oidc/scopes; allowedScopes accept them - a code / refresh carries only the API scopes whose rights the member holds now (the grant keeps what they agreed to) - internal resource-session: the token's member, live rights narrowed to its scopes, never god, marked apiScope so no rights push or refresh widens it, <=10 min, reused per token; internal issuer-by-host for the MCP gateway