Dustin Healy fcdb66bb6b 🔒 fix: Apply brutal-review hardening to Google admin refresh ... Tighten the Google OAuth refresh flow against all outstanding code review findings: enforce JWT aud claim verification against the configured clientId (ISSUER_MISMATCH on mismatch), reject ambiguous googleId matches (limit:2 in findUsers, USER_ID_MISMATCH when multiple rows match), scope the authInfo refresh-token carrier to the Google provider only, add TOCTOU re-read defense after the admin googleId migration write in socialLogin, deduplicate canAccessAdmin/mintToken closures via buildAdminRefreshClosures shared by both OpenID and Google refresh paths, document rotation semantics on AdminExchangeResponse.refreshToken, standardise all log prefixes to [admin/oauth/refresh], and expand test coverage for all new paths.		2026-06-22 09:34:41 -07:00
..
src	🔒 fix: Apply brutal-review hardening to Google admin refresh	2026-06-22 09:34:41 -07:00
types	🔬 ci: Add TypeScript Type Checks to Backend Workflow and Fix All Type Errors (#12451)	2026-03-28 21:06:39 -04:00
.gitignore
babel.config.cjs
jest.config.mjs	📦 chore: npm audit fix (#13828)	2026-06-17 21:54:04 -04:00
jest.setup.cjs	🌱 fix: Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) (#12831)	2026-04-27 08:56:39 +09:00
package.json	📦 chore: npm audit fix (#13828)	2026-06-17 21:54:04 -04:00
tsconfig-paths-bootstrap.mjs
tsconfig.build.json
tsconfig.json	📦 chore: npm audit fixes and Mongoose 8.23 TypeScript follow-ups (#12996)	2026-05-07 09:47:40 -04:00
tsconfig.spec.json	📦 chore: Update TypeScript Config for TS v7 (#12794)	2026-04-23 12:51:03 -04:00
tsdown.config.mjs	🪟 fix: Cross-Platform Absolute-Path Check in tsdown neverBundle Predicates (#13700)	2026-06-13 11:04:46 -04:00