6 Commits

Include renames

Author	SHA1	Message	Date
jcoffey-dev	d6fc4600cd	OAuth: registration required by default; first-party clients registered on every start (contract C-5, C-6)	2026-09-18 13:04:20 -07:00
jcoffey-dev	f82f15d863	Contract: note the browser sign-in check after the OAuth fix	2026-09-18 12:53:59 -07:00
jcoffey-dev	ad3322183a	Contract: record the OAuth registration fix applied on production	2026-09-18 12:40:33 -07:00
jcoffey-dev	2e2eb76301	Contract: C-7 matches C-5 (third-party OAuth apps are admin-registered unless open registration is chosen)	2026-09-18 12:31:18 -07:00
jcoffey-dev	559bb3d1a6	Contract: INBUXA production OAuth findings; C-5 also turns anonymous client registration off	2026-09-18 12:31:07 -07:00
jcoffey-dev	0ed540f43a	Contract spec: inbuxa-server, ihasmail-inbuxa and INBUXA Admin ... Discovery and a contract version in the session; front ends configured once (x:FrontEnds); OAuth with required registration, first-party clients, server-hosted sign-in and consent for everything else; per-grant revocation; cross-origin limited to the front ends; an admin lane by scope; push unchanged. Records what upstream does today, including that it accepts any client and redirect URI by default, and the phishing that allows.	2026-09-18 12:19:47 -07:00