admin 495050752a feat(api): real Zitadel token introspection (fail-closed) + expected-audience enforcement ...

- preHandler: Bearer tokens are introspected against Zitadel (RFC 7662)
- any introspection failure (unreachable, non-200, bad JSON, inactive) = 401
- asserted aud must include ZITADEL_EXPECTED_AUDIENCE (project id); absent aud accepted per RFC 7662
- config: ZITADEL_INTROSPECTION_CLIENT_ID/SECRET + ZITADEL_EXPECTED_AUDIENCE (optional; Bearer-presence fallback logs warn in prod)
- 13 new tests (introspection fail-closed matrix + preHandler flow)

2026-09-16 22:06:46 +02:00

..

c0py-core

test(core): add fidelity gate coverage

2026-09-16 21:52:45 +02:00

config

feat(api): real Zitadel token introspection (fail-closed) + expected-audience enforcement

2026-09-16 22:06:46 +02:00

types

feat(types): add canonical evidence and reconstruction contracts

2026-09-16 21:51:03 +02:00