Chris CoutinhoandClaude Opus 4.6 c3da7acc87 fix: fall back to client_id when aud claim is absent (Cognito compat) ...

AWS Cognito access tokens do not include an `aud` claim per RFC 7519 —
they use `client_id` instead. This causes `_has_mcp_audience` to reject
all Cognito-issued tokens with "Missing MCP audience. Got []".

When `aud` is empty, fall back to the `client_id` JWT claim for audience
validation. The MCP server's own client_id will be present there since
the AS proxy exchanges the authorization code using its credentials.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-07 18:06:15 +02:00

..

alembic

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

api

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

auth

fix: fall back to client_id when aud claim is absent (Cognito compat)

2026-04-07 18:06:15 +02:00

client

fix: convert BDAY datetime.date to string before Pydantic validation

2026-04-01 09:11:45 +02:00

controllers

fix: return all notes when search query is empty

2025-11-13 21:57:14 +01:00

document_processors

fix(mcp): Move all imports to the top of modules

2025-12-26 10:05:27 -06:00

embedding

fix(mcp): Move all imports to the top of modules

2025-12-26 10:05:27 -06:00

models

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

observability

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

providers

fix: resolve all type checking errors (8 errors fixed)

2025-12-08 01:09:02 +01:00

search

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

server

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

utils

feat: Add text processing background worker for telling client about progress

2025-10-25 19:52:45 +02:00

vector

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

__init__.py

Initial commit

2025-05-04 23:24:55 +02:00

app.py

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

cli.py

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

config_validators.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

config.py

fix: address second round of PR review for scope prefix

2026-04-07 16:58:29 +02:00

context.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

http.py

feat: add self-signed SSL certificate support for Nextcloud connections

2026-02-16 09:21:21 +01:00

migrations.py

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00