burstauth

Independent component of Burst Kit. See the workspace plans for V1 architecture.

Module path burstkit.dev/burstauth is provisional until repository ownership is selected. Run go test ./... from this directory.

LoginProvider now implements the OIDC relying-party code exchange using pinned go-oidc and oauth2 libraries. It verifies issuer, audience, signature, expiry, subject, nonce and authorized party. The composing app owns one-use state, PKCE verifier storage, browser binding, CSRF and server-side sessions. It is not an OIDC provider.

Authority resolves bounded delegated-grant chains from a transaction-scoped snapshot of grants and current subjects/groups. Explicit root denies override allows. Delegation requires a delegable parent, matching action, narrower or equal resource and expiry, and current issuer membership. Cycles, missing parents, revoked/expired ancestors and chains deeper than eight hops deny access. The control service persists provenance and rechecks it for every operation.

OIDC back-channel logout and live provider/browser acceptance remain outstanding.