- Shipped
- November 15, 2026 at 9:54 AM UTC
- Author
- Kamo
- Commit
- d906985
- Issuer relays: **************** and RFC 8414 **************** (Next rewrites onto /oauth/well-known/*), **************** and /o/{orgId}/oauth/{authorize, token,revoke}; X-Forwarded-Host + X-Kamo-Issuer-Org (path org 1-20 digits, else 404 without a call); discovery/JWKS keep SecurityService's public cache, everything else no-store; CORS for discovery/JWKS/userinfo; 5xx/outage = 503, never a credential error. Root /oauth/token|revoke keep SP09's exact header set (Amazon). - authorize forwards **************** only when sent (an Alexa body stays the seven); prompt=none continues the org's provider session server-side and follows SecurityService's redirect; a native app's loopback / private-scheme error is followed only when it carries iss. - Connected-app sign-in (O2 kind APP): org-branded (issuer org's palette + logo, slate fallback, dark mode), org=<alias> on /api/login, amr on the attach (pwd / pwd+otp, set by the route), attach {redirectTo} or {consentPath} + providerSession -> HttpOnly host-only kamo_op_<orgId> cookie; 409 wrong_organization card; Continue as <name> card via .../session and .../continue (HttpOnly cookie read server-side only); Not You? ends the provider session and restarts the same request. - Generic consent for kind APP: app logo beside the org's, plain scope list with New marks, Signed in as / Not You?, Allow / Don't Allow with help tips, plain refusals (ACCESS_POLICY ...); decision {consentToken, decision} only, provider cookie kept. The Alexa / Google Home / Assistant consent and sign-in are unchanged (all SP09 tests untouched and green). - RP-initiated logout page [/o/{orgId}]/oauth/end-session (server-started, Sign Out / Stay Signed In, guarded redirect); /api/logout also ends every kamo_op_* provider session (bounded 2.5 s, local key delete as backstop).