ilpanich / axiam-cplusplus-sdk / 29647191309

91%

push

github

Resolve org_id from access-token claim for the refresh body (D-14) (#2)

The refresh body previously took org_id from construction config only
(`org_id.value_or("")`), so a client built with an organization *slug*
instead of a UUID sent an empty org_id and its refresh failed the server's
`RefreshRequest` deserialization (org_id is a required UUID). The login
response body carries tenant_id/org_slug but never org_id, so — mirroring the
Rust/Go/Python/etc. reference SDKs — recover the org_id UUID from the
access-token JWT claim.

- Transport: capture `Set-Cookie` header values in a dedicated
  `HttpResponse.set_cookies` vector (the case-insensitive HeaderMap collapsed
  the several cookies a login sets, discarding axiam_access).
- Client: after a successful login/verify_mfa, decode the org_id claim out of
  the axiam_access cookie (unverified base64url decode — used only to echo the
  value the server re-derives and re-validates on refresh) into
  `resolved_org_id`, and prefer it over the configured org_id when building the
  refresh body.
- Add a test asserting a slug-only-configured client sends the decoded org_id
  UUID (not the slug) on refresh.


Claude-Session: https://claude.ai/code/session_0156crGuZKUBcWe2w5bzD9y1

Co-authored-by: Claude <noreply@anthropic.com>

254 of 340 branches covered (74.71%)

Branch coverage included in aggregate %.

36 of 36 new or added lines in 2 files covered. (100.0%)

721 of 727 relevant lines covered (99.17%)

103.32 hits per line