feat(sts): let platform IdP tokens act as accounts that trust them - #237

Merged

alukach merged 19 commits into

mainfrom

feat/platform-trust

Oct 1, 2026

Commits on Sep 30, 2026

Commits on Oct 1, 2026

refactor(sts): apply review suggestions on platform token exchange

alukach
and
claude
committed
89ae5b1
fix(sts): escape caller text in exchange error bodies (#246)

alukach
and
claude
authored
ec3f79c
refactor(sts): parse exchange parameters once for both short-circuits

alukach
and
claude
committed
21f0250
fix(sts): refuse a platform token sent in the URL

alukach
and
claude
committed
c117168
fix(config): accept PLATFORM_ISSUERS as a TOML table

alukach
and
claude
committed
8ccf862
fix(sts): rate-limit only platform exchanges the trust cache misses

alukach
and
claude
committed
cc81361
fix(sts): make a platform issuer's key failures retryable

alukach
and
claude
committed
2a1171c
docs: bring exchange comments in line with the code

alukach
and
claude
committed
6e2a5b7
test: drop a redundant assertion from the service-account test

alukach
and
claude
committed
6c9126d
refactor(sts): drop the Exchange and PlatformToken structs

alukach
and
claude
committed
e484541
refactor(cache): inline the trust answer helpers

alukach
and
claude
committed
6404e42
test(ci): cover the person route and per-issuer audiences

alukach
and
claude
committed
8938bb2
ci(staging): mint the smoke-test token only with a trust account

alukach
and
claude
committed
2ee4431
ci: give the person-issuer worker its own dev host

alukach
and
claude
committed
dc8b141
refactor(sts): inline the key id lookup

alukach
and
claude
committed
d8613f7