feat(buzz-auth): add production NIP-FI federated assertion runtime - #7109

Merged

wpfleger96 merged 13 commits into

mainfrom

duncan/nip-fi-assertion-runtime

Sep 1, 2026

Commits on Aug 31, 2026

feat(auth): NIP-FI Phase A PR 3 — production assertion runtime

committed
9b28111
fix(auth): harden JWKS boundary, reject current-status, fix generation and comment quality

committed
3758212
fix(buzz-auth): close SSRF/redirect bypass in HttpJwksFetcher; trim internal markers

committed
3c0ec83
fix(buzz-auth): validate URI + full deadline + IPv6 safe path in fetch_jwks

Duncan
and
wpfleger96
committed
8194e62
fix(buzz-auth): complete SSRF policy, cancellation-safe permit, and invariant tests

Duncan
and
wpfleger96
committed
272daca

Commits on Sep 1, 2026

fix(buzz-auth): Arc-shared verifier, IPv6 host normalization, fec0::/10 block

Duncan
and
wpfleger96
committed
5b1b2bf
feat(nip-fi): introduce JwksSourceContract as required IssuerPolicy input

Duncan
and
wpfleger96
committed
cd0b979
fix(buzz-auth): canonical URI storage, IPv6 extraction seam, and deadline-crossing oracle

Duncan
and
wpfleger96
committed
15a643e
fix(buzz-auth): injectable clock, resolved-target seam, dot-segment canon, minimal network.rs

Duncan
and
wpfleger96
committed
9a4c598
fix(buzz-core): complete is_not_global_unicast classifier; correct test witnesses

Duncan
and
wpfleger96
committed
1a5f178
fix(buzz-core): restore complete IANA classifier; correct test witnesses

Duncan
and
wpfleger96
committed
15ca575
fix: correct stale loopback test comment — rejects at validate_jwks_uri stage

Duncan
and
wpfleger96
committed
161f7bc
docs: fix SSRF and JWKS-expiry doc accuracy

Duncan
and
wpfleger96
committed
c92ee0e