ilpanich / axiam-java-sdk / 30894494545

92%

push

github

docs(contract): device (mTLS) tokens now carry aud=axiam:m2m (#36)

Syncs CONTRACT.md from the server repo for a BREAKING change to the
device-authentication path.

POST /api/v1/auth/device used to return a token stamped aud=axiam:user,
so a certificate-authenticated device passed every user-facing route
guard. It now returns aud=axiam:m2m, matching the client-credentials
path: both ways a service account can authenticate now yield a
machine-audience token.

No SDK code change is required — the device-auth call and its response
shape are unchanged, only the aud claim value differs. What changes for
SDK users:

- A §10 guard fronting a resource server that accepts device callers
  must be configured to expect axiam:m2m. A guard configured for
  axiam:user will reject device tokens, correctly — that is rule 6
  working, not a bug to work around.
- Server-side, a device token no longer reaches user-facing REST
  routes. It is accepted on the authorization-check endpoints, which
  are the machine-facing surface. Any SDK device flow that called a
  different endpoint with the device token must migrate that call
  deliberately; the previous access was implicit, not designed.

§10.1 rule 6 is updated to state the machine-facing case explicitly.

Applied as a targeted patch, not a wholesale copy of the upstream file,
so the vendored copies' pre-existing drift is preserved: 25 insertions
and exactly one deletion, that deletion being the rule-6 row this change
replaces.


Claude-Session: https://claude.ai/code/session_01SkTHvZQMV47t3UwkEtmB1D

Co-authored-by: Claude <noreply@anthropic.com>

660 of 773 branches covered (85.38%)

Branch coverage included in aggregate %.

1746 of 1852 relevant lines covered (94.28%)

4.25 hits per line