dunglas / mercure / 39233095144

90%

master: 93%

push

github

fix: scope compatibility mode to 0.x clients (#1444)

* fix: replay history for lastEventID in compatibility mode

0.x clients reconnect with the lastEventID query parameter and read the
cursor from the Last-Event-ID response field. Accept both under
protocol_version_compatibility 8, sending the 0.x field only to requests
using lastEventID or topic=.

Fixes https://github.com/dunglas/mercure/issues/1443

* fix: restrict the v7 public update exemption to legacy publish claims

Protocol 7 predates authorization details: a 1.x token must hold a grant
for every topic it publishes to, even in compatibility mode.

* fix: never mix 0.x and 1.x modes in a request

Compatibility mode relaxed the RFC 9068 checks for any token without
authorization_details, so any JWT from a shared issuer, such as an
OpenID Connect ID token, bypassed disabled anonymous access. Relax them
only for tokens carrying a mercure claim, decided once per token.

- Reject 1.x tokens in the authorization query parameter and the
  mercureAuthorization cookie.
- Require iss in 1.x tokens, also under the implicit issuer.
- Reject subscribe requests mixing 0.x and 1.x query parameters.

100 of 104 new or added lines in 8 files covered. (96.15%)

2751 of 3052 relevant lines covered (90.14%)

2674.68 hits per line