jif 36512a34ff Add account credential support to EMA token exchange helpers (#55685) ...

## What changed

- Add an account IdP identity resolver that checks ID-token bindings against trusted issuer and client provenance before discovering the refresh-token endpoint. An expired ID token does not by itself invalidate the refresh grant.
- Generalize `EmaIdpIdentity` and token exchange requests to carry caller-owned credential leases. Invoke a `finish_idp` callback after the IdP exchange and before resource authorization server I/O so callers can release their refresh guards at that boundary.
- Reject empty expected OIDC issuers and client IDs, and expose an unverified issuer hint solely for explaining legacy login migration.

GitOrigin-RevId: 34473fed82a9a6e58997664cd5e6e67049b5ee7e

2026-10-20 22:00:42 +00:00

..

src

Add account credential support to EMA token exchange helpers (#55685)

2026-10-20 22:00:42 +00:00

tests

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00