Summary

Batch 5 OAuth/SSO hardening for tracked high-priority items.

Resolved Items

• O-02 Cross-User OAuth Token Reuse

  • Resource invocation now looks up authorization_code tokens using the calling user identity only.
  • Removed service-account/platform-admin token fallback in this path.

• O-03 SSO Account via Email

  • SSO login no longer auto-links an existing account to a different auth provider.
  • Existing accounts with mismatched provider require explicit linking flow.
  • Added deny-by-default handling for explicit unverified email claims from IdP user info.

• O-04 SSO Admin Approval

  • Expired pending approvals no longer fall through to account creation.
  • Expired approvals are marked/renewed as pending and remain blocked until explicit admin action.
  • Unknown approval statuses now fail closed.

• O-06 SSO Scope Change

  • Requested SSO scopes are normalized and constrained to provider policy.
  • Enforced subset/intersection behavior against configured provider scopes (and optional metadata allowlist).
  • Invalid requested scopes now return HTTP 400.

• O-11 Authorization Code Fallback to client_credentials

  • Removed authorization_code to client_credentials fallback in OAuthManager.get_access_token.
  • authorization_code now requires explicit interactive consent flow and raises on non-interactive usage.

• O-14 SSO State Not Session-Bound (Login CSRF)

  • SSO state is now session-bound via HMAC and verified against browser session binding.
  • Login sets sso_session_id cookie; callback requires matching binding to proceed.

• O-16 OAuth authorize/status Lacks Ownership Checks

  • Added centralized gateway access enforcement for OAuth authorize/status endpoints.
  • Enforces token scope ownership checks plus visibility/team/owner/admin rules consistently.

Verification-Only Item (Intentionally Not Marked Resolved)

• O-15 OAuth fetch-tools Lacks RBAC
  • Re-validated endpoint-level permission enforcement and scoped ownership checks.
  • Added targeted regression coverage to prevent permission/ownership regressions.
  • Tracker status remains NEEDS DEVELOPER VERIFICATION per batch requirement.

Notes

• Updated SSO docs to reflect session-bound callback behavior and scope enforcement.