4 people 9067605b66 Merge commit from fork ...

* fix(crypto): use authenticated encryption for IDP intent tokens

IDP intent tokens were encrypted with AES-CFB which provides no
integrity protection, making them malleable. Switch to A256GCM via
the existing AuthAlgorithm interface (EncryptToken/DecryptToken),
the same approach already used for OIDC and session tokens.

The idpConfigEncryption key type is widened from EncryptionAlgorithm
to AuthEncryptionAlgorithm so that data-at-rest encryption (IDP
client secrets, LDAP bind passwords, SAML keys) continues to use
the CFB path unmodified.

Co-authored-by: Cursor <[email protected]>

* fix(proto): raise IDP intent token max length to 500 for authenticated tokens

The switch to authenticated A256GCM (JWE compact serialization) makes IDP
intent tokens longer (~270 chars) than the previous AES-CFB base64 output.
Raise the max_len/max_length validation and OpenAPI constraints on every
idp_intent_token field from 200 to 500 so the new tokens are accepted:
user v2/v2beta (idp + user_service), session v2/v2beta, and resources
user v3alpha.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

---------

Co-authored-by: Cursor <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>

2026-09-04 06:13:37 +02:00

..

encryption_keys.go

Merge commit from fork

2026-09-04 06:13:37 +02:00