rescue: unpushed work from station01 worktree (idp-fed-harden-work) - #205

Open

andrei-hasna wants to merge 10 commits into

mainfrom

idp-fed-harden-work

Commits on Jul 29, 2026

fix(server): grant IdP principals with emails:write tenant-wide send authority
andrei-hasna
committed
2ed41f0
fix(server): make an empty JWKS revoke the IdP key set and bound stale-if-error with a ceiling
andrei-hasna
committed
dcb149f
fix(server): key idp_principal_tenants on (sub, tenant_id); a re-grant no longer resurrects a revoked mapping
andrei-hasna
committed
20d3493
feat(server,cli): operator surface for IdP-principal federation grants
andrei-hasna
committed
b30d943
fix(server): bind IdP token claims fully — pt vs grant, header typ, nbf, own-tenant read, reconcile audit
andrei-hasna
committed
375c737
fix(server): refuse api-key signed-tid drift and put the tenant on the [api-auth] audit line
andrei-hasna
committed
28c7a31
fix(cli): narrow --type before the grant call so tsc --noEmit stays clean
andrei-hasna
committed
501865f
test(server): scrub the JWKS staleness ceiling in the hermetic harness and pin 0022 as the migration tail
andrei-hasna
committed
99387b4
fix(guards): re-pin the canonical env bridge over the JWKS staleness scrub
andrei-hasna
committed
c6a5fb4
build(sdk): regenerate self-hosted SDK for idp-principals operator surface
andrei-hasna
committed
7ae4de2