From 864b3e96d75057407e65c989c204a5955ec34e9f Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Sun, 14 Jun 2026 12:39:43 +0200 Subject: [PATCH] docs(adr): note token-exchange removed in ADR-005 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round-4 review: ADR-005 (Status: Implemented) still described the token-exchange mode (Option 2 / ENABLE_TOKEN_EXCHANGE) as an active option. Add a note to the Implementation Note section clarifying it was removed in the ADR-022/023 consolidation and only multi-audience mode ships — consistent with the ADR-004 deprecation in this PR. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/ADR-005-token-audience-validation.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/ADR-005-token-audience-validation.md b/docs/ADR-005-token-audience-validation.md index 3e6c4d6c..3330403e 100644 --- a/docs/ADR-005-token-audience-validation.md +++ b/docs/ADR-005-token-audience-validation.md @@ -14,6 +14,13 @@ This ADR has been fully implemented with key simplifications based on RFC 7519 S - Clients discover resource via PRM endpoint (RFC 9728) - Nextcloud OIDC app uses client-specific resource URLs +> **Note:** The **token-exchange mode** (Option 2 / `ENABLE_TOKEN_EXCHANGE`) +> described in the sections below was **removed** in the ADR-022 (Login Flow v2) +> / ADR-023 (OAuth AS proxy) consolidation. Only **multi-audience mode** ships; +> `ENABLE_TOKEN_EXCHANGE` / `settings.enable_token_exchange` no longer exist. +> The token-exchange references in this document are retained for historical +> context only. + ## Executive Summary This ADR addresses a critical security vulnerability where the MCP server was passing tokens intended for itself directly to Nextcloud APIs (token passthrough). We will: