Joseph Doherty 3ddb6876db fix(security): first-party JwtBearer with HS256 pinned; /auth/token mints for a cookie session only ...

The hand-rolled bearer handler is replaced by AddJwtBearer (Microsoft.AspNetCore.Authentication.JwtBearer
10.0.7, pinned on the same servicing line as the other AspNetCore packages). Validation parameters come
from JwtTokenService.BuildValidationParameters, which now pins ValidAlgorithms = HS256 for both the
bearer scheme and TryValidate; MapInboundClaims is off so the minted Role/zb:username keys resolve.
/auth/token requires the cookie scheme, so a bearer can no longer mint a fresh token for itself.

Refs #733
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

2026-10-22 13:35:54 -04:00

..

ZB.MOM.WW.OtOpcUa.AdminUI.Tests

feat(telemetry): wire TelemetryDial:CallTimeoutSeconds as the dial-establishment deadline (A5)

2026-10-22 06:38:32 -04:00

ZB.MOM.WW.OtOpcUa.ControlPlane.Tests

fix(controlplane): evict retired mesh channels and refresh PSKs off the request path

2026-10-22 10:34:39 -04:00

ZB.MOM.WW.OtOpcUa.Host.IntegrationTests

fix(historian): preserve stable alarm delivery identities

2026-10-13 07:10:58 -04:00

ZB.MOM.WW.OtOpcUa.Host.Tests

fix(host): refuse unknown API-key ids in memory and budget store misses; document the mesh gate's boot window

2026-10-22 10:39:12 -04:00

ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests

Retain and replay ServiceLevel across publisher binding and failures

2026-10-13 13:26:27 -04:00

ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests

chore(historian): review cleanups for the raw cap

2026-10-22 10:41:37 -04:00

ZB.MOM.WW.OtOpcUa.Runtime.Tests

Merge lane A: runtime driver lifecycle (#731)

2026-10-22 10:44:22 -04:00

ZB.MOM.WW.OtOpcUa.Security.Tests

fix(security): first-party JwtBearer with HS256 pinned; /auth/token mints for a cookie session only

2026-10-22 13:35:54 -04:00