[osanderson]

Fixes the CIBA Lows 1, 2 and 5 and the grant-registry Lows 2, 3 and 4 from the v0.74.0 security review, plus three Info items. It doesn't depend on #866 or #867.

Changes

Finding	Before	After
CIBA lookup during a store outage	LookupBackchannelInteraction answered it as invalid_request, so the inbox showed empty and DenyBackchannelInteractions returned (0, nil)	An outage is server_error; a client no longer registered is unauthorized_client (as LookupInteraction answers)
One bad entry	An unreadable record, or a pending request from a deregistered client, failed the whole listing, and with it erasure, until it expired	A deregistered client's request leaves the inbox. RevokeSubjectGrants / DenyBackchannelInteractions act on every readable entry, carry on past failures, and report every failure joined, with the count. RevokeListedGrant revokes a readable grant whatever the others' state
Code reuse	Revoked the refresh token, but its registry entry stayed listed	The entry is removed too
Stale CIBA entry	A decided request whose removal failed stayed listed until expiry	DenyBackchannelInteractions clears it when it finds the request already decided
Forged or moved entries	Not cross-checked	A grant entry whose refresh-token hash doesn't derive its key isn't listed, so RevokeListedGrant can't be steered at another token. An inbox entry whose request is bound to another subject than the one it's filed under isn't listed
Docs	Overclaimed	Dependencies.BackchannelInbox now says a handle can still end a request for anyone; only approval is bound to the user. RevokeSubjectGrants and GETTING_STARTED now say that account closure misses grants still in flight (an unexchanged code, an unpolled CIBA approval): refuse the subject at sign-in, and revoke again once those lifetimes pass

ListGrants and ListBackchannelInteractions still fail on an unreadable entry rather than hide it. Only the bulk revoke and deny calls carry on past one.

Tests

• Code reuse: removes the reused code's registry entry.
• Bulk revoke: RevokeSubjectGrants revokes the readable grant past an unreadable entry, and attempts every grant when deletes fail. RevokeListedGrant works past an unreadable entry.
• Forged entries: mismatched-hash entries aren't listed or revocable.
• CIBA:
  • a deregistered client's request is skipped;
  • a backchannel-store outage fails List and Deny;
  • Deny clears a stale decided entry;
  • a moved inbox entry isn't listed;
  • LookupBackchannelInteraction's error codes cover an unregistered client, an unavailable client store, an unreadable request and an unavailable backchannel store.
• Updated tests: the crafted registry entries in the tests now derive their keys as the server does (server.GrantEntryKey, from a test-only export_test.go).
• Checks: all modules pass at Go 1.26.11; golangci-lint is clean.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud