maaz519 3298401772 feat: enforce realtime delegation audience on the message socket ...

The socket used to accept any valid token, so a full REST/actor token could open the
live stream. Now it can require a narrowly-scoped delegated token (aud=iios-message),
so a leaked socket token can't drive privileged REST, and vice-versa.

- MessagePrincipal gains `audience`, surfaced from both verify paths (OIDC aud, and the
  app-token `aud` claim).
- message.gateway: when IIOS_REALTIME_AUDIENCE is set, handleConnection accepts only a
  token whose aud matches (opt-in, like IIOS_REQUIRE_ATTESTATION; unset = no change).
- spec: verifier surfaces aud; gateway accepts iios-message, rejects iios-core / no-aud
  when enforcing, passes through when off.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-15 12:56:19 +05:30

.claude/memory

docs: add repo-local project memory under .claude/memory/

2026-07-09 19:55:38 +05:30

.gitea/workflows

build: publish @insignia/iios-* SDKs to the Gitea package registry

2026-07-10 17:13:55 +05:30

.github/workflows

ci: start Postgres via docker run on localhost (services: not wired on runner)

2026-07-04 15:25:30 +00:00

apps

feat(p8): meeting-studio demo + smoke-calendar; P8 verification green

2026-07-01 18:22:24 +05:30

docs

build: publish @insignia/iios-* SDKs to the Gitea package registry

2026-07-10 17:13:55 +05:30

packages

feat: enforce realtime delegation audience on the message socket

2026-07-15 12:56:19 +05:30

scripts

fix(iios): thread subject on create, graceful open_thread error, isolated test DB

2026-07-06 19:39:19 +05:30

test

ci: import-boundary law + CI workflow (P0 complete)

2026-06-30 21:09:37 +05:30

.dockerignore

chore(iios): production Dockerfile + migrate entrypoint + env/secrets contract

2026-07-03 19:19:13 +05:30

.env.example

chore: iios workspace skeleton (pnpm workspace, configs, postgres:5434)

2026-06-30 20:56:36 +05:30

.gitignore

chore: iios workspace skeleton (pnpm workspace, configs, postgres:5434)

2026-06-30 20:56:36 +05:30

.npmrc

build: publish @insignia/iios-* SDKs to the Gitea package registry

2026-07-10 17:13:55 +05:30

CLAUDE.md

docs: add repo-local project memory under .claude/memory/

2026-07-09 19:55:38 +05:30

docker-compose.yml

feat(iios): socket.io Redis adapter for cross-replica realtime (P9 scaling)

2026-07-03 19:28:11 +05:30

package.json

build: publish @insignia/iios-* SDKs to the Gitea package registry

2026-07-10 17:13:55 +05:30

pnpm-lock.yaml

feat: verify context attestations via ES256/JWKS + rename client to appshell-crm

2026-07-15 12:56:10 +05:30

pnpm-workspace.yaml

feat(demo): P2.7 Vite React two-pane realtime demo + dev token endpoint (P2 complete)

2026-07-01 01:36:14 +05:30

PUBLISHING.md

build: publish @insignia/iios-* SDKs to the Gitea package registry

2026-07-10 17:13:55 +05:30

tsconfig.base.json

chore: iios workspace skeleton (pnpm workspace, configs, postgres:5434)

2026-06-30 20:56:36 +05:30

vitest.config.ts

fix(iios): thread subject on create, graceful open_thread error, isolated test DB

2026-07-06 19:39:19 +05:30

S

Description

No description provided

1.6 MiB

Languages

TypeScript 88.8%

JavaScript 10.4%

Dockerfile 0.4%

HTML 0.3%

Shell 0.1%