Rename resource token claim person_token_jti to presented_jti (dual-emit) - #23
Merged
Conversation
…ssue #95) The spec renamed the claim: the old name asserted the presented credential was a person token, which is false on step-up and per-call challenges. The value is unchanged — the jti of the person token whose verification established ps and sub. Transition strategy: createResourceToken dual-emits presented_jti (canonical) and person_token_jti (deprecated alias, same value) so PSes that still read the old name keep working; the alias goes away once the fleet's PSes read the new one. mockin 2.0.0 still resolves by the legacy name, and the e2e suite passing against it is the proof the dual-emit holds. No package in this repo reads the claim at runtime — the PS side lives elsewhere — so there is no accept-either read path to add here. Comments, docs and the e2e mint knob (forgePersonTokenJti → forgePresentedJti) now name presented_jti as canonical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hb3JdCGpyWkWVYsH51j1yU
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hb3JdCGpyWkWVYsH51j1yU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec issue dickhardt/AAuth#95 renamed the resource token claim
person_token_jti→presented_jti(same value: thejtiof the person token whose verification establishedps/sub).@aauth/resource2.1.0:createResourceTokenemits bothpresented_jti(canonical) andperson_token_jti(deprecated alias) so pre-rename PSes keep working through the transition.forgePresentedJti).Full monorepo: 739 tests passing incl. e2e against
@hellocoop/mockin@2.0.0(a legacy-only reader) — proving the dual-emit keeps old PSes working.🤖 Generated with Claude Code
https://claude.ai/code/session_01Hb3JdCGpyWkWVYsH51j1yU