[pantierra]

Stricter login token checks, and safer loading of the login server's settings.

Token checks

• Scopes must match exactly. Before, a token with scope ab was accepted where scope a was required.
• A token without scopes on a protected route now gets 401. Before, the server crashed with an error.
• Empty tokens are rejected.
• Tokens are no longer written to the logs.
• Tokens must have an expiry time (exp) and an issuer (iss), and the issuer must be our login server.

Loading the login server's settings

• The request now times out after 10 seconds (discovery_timeout). Before, the app could hang at startup forever.
• Every failure now raises one clear error, OidcFetchError.
• The loaded settings are kept, so other code can reuse them.

Breaking change
Tokens without exp or iss, or with a different issuer, are rejected now.

• To get the old behaviour back, set required_claims=().
• If your app reaches the login server at an internal address, set issuer to the public one.

[claude]

Claude finished @pantierra's task in 17s —— View job

---

✅ No blocking issues — safe to merge.

I read the diff for auth.py, config.py, __init__.py, the README and the conftest changes. I didn't run the test suite.

• Scope matching: it now compares against scope.split(), so ab no longer satisfies a. A missing or non-string scope gives 401 instead of a KeyError.
• Header handling: empty tokens are rejected, and the header is no longer logged.
• Issuer and claims: iss is only checked when it's in required_claims, so required_claims=() restores the old behaviour. A discovery document with no issuer fails fast with OidcFetchError.
• Discovery errors: OSError covers HTTP errors, unreachable hosts and timeouts. ValueError covers bad JSON. The missing-jwks_uri check is also sound.
• JWKS outage: it returns 401 and is logged at warning, so operators can tell it from a bad token.

Simplify (ponytail) — advisory only

• auth.py _validate_header with functools.partial in create_auth_token_dependency: the factory's inner auth_token could call _validate_header directly with the captured arguments. That would drop the partial and one level of indirection.
• auth.py _unauthorized: the challenge parameter is only used for the scope case. Inlining the one scoped call would let you drop the parameter. This is minor.

---

💰 Estimated review cost: $0.11 · 0m16s · 5 turns