Realm machinery tests: resolution, validation, dispatch, code binding, conversion
- Registry resolve order (exact rp-id, auth host, related origin,
longest suffix), port/trailing-dot normalization, unknown hosts.
- Cross-realm validate_config: related-origin cap, auth-host/related
collisions, related-inside-other-realm, auth-host vs rp-id.
- ASGI dispatch: HTTP 421, realm in scope state, contextvar scoping and
reset, WS pre-accept close and cross-realm effective-auth-host rule.
- Auth codes bound to issuing realm (set-session and OIDC token).
- Legacy conversion stamps credentials/sessions/OIDC with the rp-id.
- OIDC key censoring in transaction logs; bootstrap default-realm caveat.
LeoVasanko
cdabc5d9e6