Security hardening + correctness fixes: WS authz, OAuth2 OIDC, file-service IDOR, macro feature-gating#20

Merged

JedimEmO merged 12 commits into

security/websocket-authz

Jun 10, 2026

Commits on Jun 9, 2026

fix(security): re-apply WebSocket authz hardening

JedimEmO
and
claude
committed
fix(client): remove connect() busy-wait and pending-request leak

JedimEmO
and
claude
committed
fix(manager): no DashMap guards across awaits, concurrent fan-out, subscription races

JedimEmO
and
claude
committed
fix(server): answer unparseable WS frames with -32700 instead of dropping the connection

JedimEmO
and
claude
committed
fix(rest-macro): parse request bodies only after auth, add body_limit option

JedimEmO
and
claude
committed
refactor(auth): single shared authorization pipeline in ras-auth-core

JedimEmO
and
claude
committed
refactor(oauth2): typed start_flow API instead of success-inside-Err

JedimEmO
and
claude
committed
feat(macros): opt-in consumer-driven feature gating (feature_gated: true)

JedimEmO
and
claude
committed
fix(examples): close IDOR and content-type sniffing in file-service backend

JedimEmO
and
claude
committed
fix(oauth2): OIDC nonce, id_token claim validation, login-CSRF session binding

JedimEmO
and
claude
committed
fix: bound in-memory stores and add WebSocket connection cap

JedimEmO
and
claude
committed
docs(oauth2): fix bare URL in issuer field doc comment

JedimEmO
and
claude
committed