Include the hash of the access token in the JWT / ID Token under the key at_hash as per the requirements. Update the discovery endpoint to describe subject_type as 'pairwise', rather than 'public', since we do pairwise subject ids.

Use SolidQueue in production. Use the find_by_token method, rather than iterating over refresh tokens, as we already fixed for tokens
Improve the README
2025-12-31 14:45:38 +11:00 · 2025-12-31 14:32:34 +11:00 · 2025-12-31 14:31:53 +11:00 · 2025-12-31 12:17:15 +11:00 · 2025-12-31 11:56:09 +11:00 · 2025-12-31 11:44:11 +11:00
107 changed files with 7394 additions and 1072 deletions
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,21 @@
 # Rails Configuration
-SECRET_KEY_BASE=generate-with-bin-rails-secret
+# SECRET_KEY_BASE is used for:
+#   - Session cookie encryption
+#   - Signed token verification
+#   - ActiveRecord encryption (currently: TOTP secrets)
+#   - OIDC token prefix HMAC derivation
+#
+# CRITICAL: Do NOT change SECRET_KEY_BASE after deployment. Changing it will:
+#   - Invalidate all user sessions (users must re-login)
+#   - Break encrypted data (users must re-setup 2FA)
+#   - Invalidate all OIDC access/refresh tokens (clients must re-authenticate)
+#
+# Optional: Override encryption keys with env vars for key rotation:
+#   - ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
+#   - ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
+#   - ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
+#   - OIDC_TOKEN_PREFIX_HMAC
+SECRET_KEY_BASE=generate-with-bin/rails/secret
 RAILS_ENV=development

 # Database
--- a/2
+++ b/2
@@ -11,6 +11,8 @@
 ARG RUBY_VERSION=3.4.6
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base

+LABEL org.opencontainers.image.source=https://github.com/dkam/clinch
+
 # Rails app lives here
 WORKDIR /rails

--- a/6
+++ b/6
@@ -35,11 +35,11 @@ gem "jwt", "~> 3.1"
 gem "webauthn", "~> 3.0"

 # Public Suffix List for domain parsing
-gem "public_suffix", "~> 6.0"
+gem "public_suffix", "~> 7.0"

 # Error tracking and performance monitoring (optional, configured via SENTRY_DSN)
-gem "sentry-ruby", "~> 5.18"
-gem "sentry-rails", "~> 5.18"
+gem "sentry-ruby", "~> 6.2"
+gem "sentry-rails", "~> 6.2"

 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
 gem "tzinfo-data", platforms: %i[ windows jruby ]
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -75,8 +75,8 @@ GEM
      securerandom (>= 0.3)
      tzinfo (~> 2.0, >= 2.0.5)
      uri (>= 0.13.1)
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.8.8)
+      public_suffix (>= 2.0.2, < 8.0)
    android_key_attestation (0.3.0)
    ast (2.4.3)
    base64 (0.3.0)
@@ -85,13 +85,13 @@ GEM
    bigdecimal (3.3.1)
    bindata (2.5.1)
    bindex (0.8.1)
-    bootsnap (1.18.6)
+    bootsnap (1.19.0)
      msgpack (~> 1.2)
-    brakeman (7.1.0)
+    brakeman (7.1.1)
      racc
    builder (3.3.0)
-    bundler-audit (0.9.2)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
      thor (~> 1.0)
    capybara (3.40.0)
      addressable
@@ -107,7 +107,7 @@ GEM
      logger (~> 1.5)
    chunky_png (1.4.0)
    concurrent-ruby (1.3.5)
-    connection_pool (2.5.4)
+    connection_pool (2.5.5)
    cose (1.3.1)
      cbor (~> 0.5.9)
      openssl-signature_algorithm (~> 1.0)
@@ -119,8 +119,9 @@ GEM
    dotenv (3.1.8)
    drb (2.2.3)
    ed25519 (1.4.0)
-    erb (5.1.3)
+    erb (6.0.0)
    erubi (1.13.1)
+    ffi (1.17.2)
    ffi (1.17.2-aarch64-linux-gnu)
    ffi (1.17.2-aarch64-linux-musl)
    ffi (1.17.2-arm-linux-gnu)
@@ -147,10 +148,10 @@ GEM
    jbuilder (2.14.1)
      actionview (>= 7.0.0)
      activesupport (>= 7.0.0)
-    json (2.15.2)
+    json (2.16.0)
    jwt (3.1.2)
      base64
-    kamal (2.8.1)
+    kamal (2.9.0)
      activesupport (>= 7.0)
      base64 (~> 0.2)
      bcrypt_pbkdf (~> 1.0)
@@ -184,7 +185,8 @@ GEM
    mini_magick (5.3.1)
      logger
    mini_mime (1.1.5)
-    minitest (5.26.0)
+    mini_portile2 (2.8.9)
+    minitest (5.26.2)
    msgpack (1.8.0)
    net-imap (0.5.12)
      date
@@ -201,6 +203,9 @@ GEM
      net-protocol
    net-ssh (7.3.0)
    nio4r (2.7.5)
+    nokogiri (1.18.10)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
    nokogiri (1.18.10-aarch64-linux-gnu)
      racc (~> 1.4)
    nokogiri (1.18.10-aarch64-linux-musl)
@@ -220,7 +225,7 @@ GEM
      openssl (> 2.0)
    ostruct (0.6.3)
    parallel (1.27.0)
-    parser (3.3.9.0)
+    parser (3.3.10.0)
      ast (~> 2.4.1)
      racc
    pp (0.6.3)
@@ -234,7 +239,7 @@ GEM
    psych (5.2.6)
      date
      stringio
-    public_suffix (6.0.2)
+    public_suffix (7.0.0)
    puma (7.1.0)
      nio4r (~> 2.0)
    racc (1.8.1)
@@ -278,20 +283,20 @@ GEM
      zeitwerk (~> 2.6)
    rainbow (3.1.1)
    rake (13.3.1)
-    rdoc (6.15.1)
+    rdoc (6.16.1)
      erb
      psych (>= 4.0.0)
      tsort
    regexp_parser (2.11.3)
-    reline (0.6.2)
+    reline (0.6.3)
      io-console (~> 0.5)
    rexml (3.4.4)
    rotp (6.3.0)
-    rqrcode (3.1.0)
+    rqrcode (3.1.1)
      chunky_png (~> 1.0)
      rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
-    rubocop (1.81.6)
+    rqrcode_core (2.0.1)
+    rubocop (1.81.7)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
@@ -302,14 +307,14 @@ GEM
      rubocop-ast (>= 1.47.1, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.47.1)
+    rubocop-ast (1.48.0)
      parser (>= 3.3.7.2)
      prism (~> 1.4)
    rubocop-performance (1.26.1)
      lint_roller (~> 1.1)
      rubocop (>= 1.75.0, < 2.0)
      rubocop-ast (>= 1.47.1, < 2.0)
-    rubocop-rails (2.33.4)
+    rubocop-rails (2.34.2)
      activesupport (>= 4.2.0)
      lint_roller (~> 1.1)
      rack (>= 1.1)
@@ -323,7 +328,7 @@ GEM
    ruby-vips (2.2.5)
      ffi (~> 1.12)
      logger
-    rubyzip (3.2.1)
+    rubyzip (3.2.2)
    safety_net_attestation (0.5.0)
      jwt (>= 2.0, < 4.0)
    securerandom (0.4.1)
@@ -333,10 +338,10 @@ GEM
      rexml (~> 3.2, >= 3.2.5)
      rubyzip (>= 1.2.2, < 4.0)
      websocket (~> 1.0)
-    sentry-rails (5.28.0)
-      railties (>= 5.0)
-      sentry-ruby (~> 5.28.0)
-    sentry-ruby (5.28.0)
+    sentry-rails (6.2.0)
+      railties (>= 5.2.0)
+      sentry-ruby (~> 6.2.0)
+    sentry-ruby (6.2.0)
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
    solid_cable (3.0.12)
@@ -344,17 +349,19 @@ GEM
      activejob (>= 7.2)
      activerecord (>= 7.2)
      railties (>= 7.2)
-    solid_cache (1.0.8)
+    solid_cache (1.0.10)
      activejob (>= 7.2)
      activerecord (>= 7.2)
      railties (>= 7.2)
-    sqlite3 (2.7.4-aarch64-linux-gnu)
-    sqlite3 (2.7.4-aarch64-linux-musl)
-    sqlite3 (2.7.4-arm-linux-gnu)
-    sqlite3 (2.7.4-arm-linux-musl)
-    sqlite3 (2.7.4-arm64-darwin)
-    sqlite3 (2.7.4-x86_64-linux-gnu)
-    sqlite3 (2.7.4-x86_64-linux-musl)
+    sqlite3 (2.8.1)
+      mini_portile2 (~> 2.8.0)
+    sqlite3 (2.8.1-aarch64-linux-gnu)
+    sqlite3 (2.8.1-aarch64-linux-musl)
+    sqlite3 (2.8.1-arm-linux-gnu)
+    sqlite3 (2.8.1-arm-linux-musl)
+    sqlite3 (2.8.1-arm64-darwin)
+    sqlite3 (2.8.1-x86_64-linux-gnu)
+    sqlite3 (2.8.1-x86_64-linux-musl)
    sshkit (1.24.0)
      base64
      logger
@@ -364,16 +371,16 @@ GEM
      ostruct
    stimulus-rails (1.3.4)
      railties (>= 6.0.0)
-    stringio (3.1.7)
-    tailwindcss-rails (4.3.0)
+    stringio (3.1.8)
+    tailwindcss-rails (4.4.0)
      railties (>= 7.0.0)
      tailwindcss-ruby (~> 4.0)
-    tailwindcss-ruby (4.1.13)
-    tailwindcss-ruby (4.1.13-aarch64-linux-gnu)
-    tailwindcss-ruby (4.1.13-aarch64-linux-musl)
-    tailwindcss-ruby (4.1.13-arm64-darwin)
-    tailwindcss-ruby (4.1.13-x86_64-linux-gnu)
-    tailwindcss-ruby (4.1.13-x86_64-linux-musl)
+    tailwindcss-ruby (4.1.16)
+    tailwindcss-ruby (4.1.16-aarch64-linux-gnu)
+    tailwindcss-ruby (4.1.16-aarch64-linux-musl)
+    tailwindcss-ruby (4.1.16-arm64-darwin)
+    tailwindcss-ruby (4.1.16-x86_64-linux-gnu)
+    tailwindcss-ruby (4.1.16-x86_64-linux-musl)
    thor (1.4.0)
    thruster (0.1.16)
    thruster (0.1.16-aarch64-linux)
@@ -385,15 +392,15 @@ GEM
      openssl (> 2.0)
      openssl-signature_algorithm (~> 1.0)
    tsort (0.2.0)
-    turbo-rails (2.0.17)
+    turbo-rails (2.0.20)
      actionpack (>= 7.1.0)
      railties (>= 7.1.0)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
    unicode-display_width (3.2.0)
      unicode-emoji (~> 4.1)
-    unicode-emoji (4.1.0)
-    uri (1.1.0)
+    unicode-emoji (4.2.0)
+    uri (1.1.1)
    useragent (0.16.11)
    web-console (4.2.1)
      actionview (>= 6.0.0)
@@ -442,15 +449,15 @@ DEPENDENCIES
  kamal
  letter_opener
  propshaft
-  public_suffix (~> 6.0)
+  public_suffix (~> 7.0)
  puma (>= 5.0)
  rails (~> 8.1.1)
  rotp (~> 6.3)
  rqrcode (~> 3.1)
  rubocop-rails-omakase
  selenium-webdriver
-  sentry-rails (~> 5.18)
-  sentry-ruby (~> 5.18)
+  sentry-rails (~> 6.2)
+  sentry-ruby (~> 6.2)
  solid_cable
  solid_cache
  sqlite3 (>= 2.1)
--- a/README.md
+++ b/README.md
@@ -1,31 +1,15 @@
 # Clinch

 > [!NOTE]
-> This software is experiemental. If you'd like to try it out, find bugs, security flaws and improvements, please do. 
+> This software is experimental. If you'd like to try it out, find bugs, security flaws and improvements, please do. 

 **A lightweight, self-hosted identity & SSO / IpD portal**

-Clinch gives you one place to manage users and lets any web app authenticate against it without maintaining its own user table. 
-
-I've completed all planned features: 
-
-* Create Admin user on first login
-* TOTP ( QR Code ) 2FA, with backup codes ( encrypted at rest )
-* Passkey generation and login, with detection of Passkey during login
-* Forward Auth configured and working
-* OIDC provider with auto discovery working
-* Invite users by email, assign to groups
-* Self managed password reset by email
-* Use Groups to assign Applications ( Family group can access Kavita, Developers can access Gitea )
-* Configurable Group and User custom claims for OIDC token
-* Display all Applications available to the user on their Dashboard
-* Display all logged in sessions and OIDC logged in sessions
-
-What remains now is ensure test coverage, 
+Clinch gives you one place to manage users and lets any web app authenticate against it without managing its own users.

 ## Why Clinch?

-Do you host your own web apps? MeTube, Kavita, Audiobookshelf, Gitea? Rather than managing all those separate user accounts, set everyone up on Clinch and let it do the authentication and user management.
+Do you host your own web apps? MeTube, Kavita, Audiobookshelf, Gitea, Grafana, Proxmox? Rather than managing all those separate user accounts, set everyone up on Clinch and let it do the authentication and user management.

 Clinch sits in a sweet spot between two excellent open-source identity solutions:

@@ -75,30 +59,40 @@ Clinch sits in a sweet spot between two excellent open-source identity solutions
 - **User statuses** - Active, disabled, or pending invitation

 ### Authentication Methods
+- **WebAuthn/Passkeys** - Modern passwordless authentication using FIDO2 standards
 - **Password authentication** - Secure bcrypt-based password storage
- **Magic login links** - Passwordless login via email (15-minute expiry)
 - **TOTP 2FA** - Optional time-based one-time passwords with QR code setup
 - **Backup codes** - 10 single-use recovery codes per user
- **Configurable 2FA enforcement** - Admins can require TOTP for specific users/groups
+- **Configurable 2FA enforcement** - Admins can require TOTP for specific users

 ### SSO Protocols

+Apps that speak OIDC use the OIDC flow.
+Apps that only need "who is it?", or you want available from the internet behind authentication (MeTube, Jellyfin) use ForwardAuth.
+
 #### OpenID Connect (OIDC)
 Standard OAuth2/OIDC provider with endpoints:
 - `/.well-known/openid-configuration` - Discovery endpoint
- `/authorize` - Authorization endpoint
- `/token` - Token endpoint
+- `/authorize` - Authorization endpoint with PKCE support
+- `/token` - Token endpoint (authorization_code and refresh_token grants)
 - `/userinfo` - User info endpoint
+- `/revoke` - Token revocation endpoint (RFC 7009)

-Client apps (Audiobookshelf, Kavita, Grafana, etc.) redirect to Clinch for login and receive ID tokens and access tokens.
+Features:
+- **Refresh tokens** - Long-lived tokens (30 days default) with automatic rotation and revocation
+- **Token family tracking** - Advanced security detects token replay attacks and revokes compromised token families
+- **Configurable token expiry** - Set access token (5min-24hr), refresh token (1-90 days), and ID token TTL per application
+- **Token security** - BCrypt-hashed tokens, automatic cleanup of expired tokens
+- **Pairwise subject identifiers** - Each user gets a unique, stable `sub` claim per application for enhanced privacy
+
+Client apps (Audiobookshelf, Kavita, Proxmox, Grafana, etc.) redirect to Clinch for login and receive ID tokens, access tokens, and refresh tokens.

 #### Trusted-Header SSO (ForwardAuth)
 Works with reverse proxies (Caddy, Traefik, Nginx):
 1. Proxy sends every request to `/api/verify`
-2. **200 OK** → Proxy injects headers (`Remote-User`, `Remote-Groups`, `Remote-Email`) and forwards to app
-3. **401/403** → Proxy redirects to Clinch login; after login, user returns to original URL
-
-Apps that speak OIDC use the OIDC flow; apps that only need "who is it?" headers use ForwardAuth.
+2. Response handling:
+   - **200 OK** → Proxy injects headers (`Remote-User`, `Remote-Groups`, `Remote-Email`) and forwards to app
+   - **Any other status** → Proxy returns that response directly to client (typically 302 redirect to login page)

 **Note:** ForwardAuth requires applications to run on the same domain as Clinch (e.g., `app.yourdomain.com` with Clinch at `auth.yourdomain.com`) for secure session cookie sharing. Take a look at Authentik if you need multi domain support.

@@ -106,7 +100,6 @@ Apps that speak OIDC use the OIDC flow; apps that only need "who is it?" headers
 Send emails for:
 - Invitation links (one-time token, 7-day expiry)
 - Password reset links (one-time token, 1-hour expiry)
- 2FA backup codes

 ### Session Management
 - **Device tracking** - See all active sessions with device names and IPs
@@ -114,10 +107,54 @@ Send emails for:
 - **Session revocation** - Users and admins can revoke individual sessions

 ### Access Control
- **Group-based allowlists** - Restrict applications to specific user groups
- **Per-application access** - Each app defines which groups can access it
- **Automatic enforcement** - Access checks during OIDC authorization and ForwardAuth
- **Custom claims** - Add arbitrary claims to OIDC tokens via groups and users (perfect for app-specific roles)
+
+#### Group-Based Application Access
+Clinch uses groups to control which users can access which applications:
+
+- **Create groups** - Organize users into logical groups (readers, editors, family, developers, etc.)
+- **Assign groups to applications** - Each app defines which groups are allowed to access it
+  - Example: Kavita app allows the "readers" group → only users in the "readers" group can sign in
+  - If no groups are assigned to an app → all active users can access it
+- **Automatic enforcement** - Access checks happen automatically:
+  - During OIDC authorization flow (before consent)
+  - During ForwardAuth verification (before proxying requests)
+  - Users not in allowed groups receive a "You do not have permission" error
+
+#### Group Claims in Tokens
+- **OIDC tokens include group membership** - ID tokens contain a `groups` claim with all user's groups
+- **Custom claims** - Add arbitrary key-value pairs to tokens via groups and users
+  - Group claims apply to all members (e.g., `{"role": "viewer"}`)
+  - User claims override group claims for fine-grained control
+  - Perfect for app-specific authorization (e.g., admin vs. read-only roles)
+
+#### Custom Claims Merging
+Custom claims from groups and users are merged into OIDC ID tokens with the following precedence:
+
+1. **Default OIDC claims** - Standard claims (`iss`, `sub`, `aud`, `exp`, `email`, etc.)
+2. **Standard Clinch claims** - `groups` array (list of user's group names)
+3. **Group custom claims** - Merged in order; later groups override earlier ones
+4. **User custom claims** - Override all group claims
+5. **Application-specific claims** - Highest priority; override all other claims
+
+**Example:**
+- Group "readers" has `{"role": "viewer", "max_items": 10}`
+- Group "premium" has `{"role": "subscriber", "max_items": 100}`
+- User (in both groups) has `{"max_items": 500}`
+- **Result:** `{"role": "subscriber", "max_items": 500}` (user overrides max_items, premium overrides role)
+
+#### Application-Specific Claims
+Configure different claims for different applications on a per-user basis:
+
+- **Per-app customization** - Each application can have unique claims for each user
+- **Highest precedence** - App-specific claims override group and user global claims
+- **Use case** - Different roles in different apps (e.g., admin in Kavita, user in Audiobookshelf)
+- **Admin UI** - Configure via Admin → Users → Edit User → App-Specific Claim Overrides
+
+**Example:**
+- User Alice, global claims: `{"theme": "dark"}`
+- Kavita app-specific: `{"kavita_groups": ["admin"]}`
+- Audiobookshelf app-specific: `{"abs_groups": ["user"]}`
+- **Result:** Kavita receives `{"theme": "dark", "kavita_groups": ["admin"]}`, Audiobookshelf receives `{"theme": "dark", "abs_groups": ["user"]}`

 ---

@@ -156,25 +193,29 @@ Send emails for:
 - Redirect URIs (for OIDC apps)
 - Domain pattern (for ForwardAuth apps, supports wildcards like *.example.com)
 - Headers config (for ForwardAuth apps, JSON configuration for custom header names)
+- Token TTL configuration (access_token_ttl, refresh_token_ttl, id_token_ttl)
 - Metadata (flexible JSON storage)
 - Active flag
 - Many-to-many with Groups (allowlist)

 **OIDC Tokens**
- Authorization codes (10-minute expiry, one-time use)
- Access tokens (1-hour expiry, revocable)
+- Authorization codes (10-minute expiry, one-time use, PKCE support)
+- Access tokens (opaque, BCrypt-hashed, configurable expiry 5min-24hr, revocable)
+- Refresh tokens (opaque, BCrypt-hashed, configurable expiry 1-90 days, single-use with rotation)
+- ID tokens (JWT, signed with RS256, configurable expiry 5min-24hr)

 ---

 ## Authentication Flows

 ### OIDC Authorization Flow
-1. Client redirects user to `/authorize` with client_id, redirect_uri, scope
+1. Client redirects user to `/authorize` with client_id, redirect_uri, scope (optional PKCE)
 2. User authenticates with Clinch (username/password + optional TOTP)
 3. Access control check: Is user in an allowed group for this app?
 4. If allowed, generate authorization code and redirect to client
-5. Client exchanges code for access token at `/token`
-6. Client uses access token to fetch user info from `/userinfo`
+5. Client exchanges code at `/token` for ID token, access token, and refresh token
+6. Client uses access token to fetch fresh user info from `/userinfo`
+7. When access token expires, client uses refresh token to get new tokens (no re-authentication)

 ### ForwardAuth Flow
 1. User requests protected resource at `https://app.example.com/dashboard`
@@ -258,6 +299,10 @@ SMTP_ENABLE_STARTTLS=true
 # Application
 CLINCH_HOST=https://auth.example.com
 CLINCH_FROM_EMAIL=noreply@example.com
+
+# OIDC (optional - generates temporary key in development)
+# Generate with: openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048
+OIDC_PRIVATE_KEY=<contents-of-private-key.pem>
 ```

 ### First Run
@@ -271,24 +316,180 @@ CLINCH_FROM_EMAIL=noreply@example.com

 ---

-## Roadmap
+## Rails Console

-### In Progress
- OIDC provider implementation
- ForwardAuth endpoint
- Admin UI for user/group/app management
- First-run wizard
+One advantage of being a Rails application is direct access to the Rails console for administrative tasks. This is particularly useful for debugging, emergency access, or bulk operations.

-### Planned Features
- **Audit logging** - Track all authentication events
- **WebAuthn/Passkeys** - Hardware key support
+### Starting the Console

-#### Maybe
- **SAML support** - SAML 2.0 identity provider
- **Policy engine** - Rule-based access control
-  - Example: `IF user.email =~ "*@gmail.com" AND app.slug == "kavita" THEN DENY`
-  - Stored as JSON, evaluated after auth but before consent
- **LDAP sync** - Import users from LDAP/Active Directory
+```bash
+# Docker / Docker Compose
+docker exec -it clinch bin/rails console
+# or
+docker compose exec -it clinch bin/rails console
+
+# Local development
+bin/rails console
+```
+
+### Finding Users
+
+```ruby
+# Find by email
+user = User.find_by(email_address: 'alice@example.com')
+
+# Find by username
+user = User.find_by(username: 'alice')
+
+# List all users
+User.all.pluck(:id, :email_address, :status)
+
+# Find admins
+User.admins.pluck(:email_address)
+
+# Find users in a specific status
+User.active.count
+User.disabled.pluck(:email_address)
+User.pending_invitation.pluck(:email_address)
+```
+
+### Creating Users
+
+```ruby
+# Create a regular user
+User.create!(
+  email_address: 'newuser@example.com',
+  password: 'secure-password-here',
+  status: :active
+)
+
+# Create an admin user
+User.create!(
+  email_address: 'admin@example.com',
+  password: 'secure-password-here',
+  status: :active,
+  admin: true
+)
+```
+
+### Managing Passwords
+
+```ruby
+user = User.find_by(email_address: 'alice@example.com')
+user.password = 'new-secure-password'
+user.save!
+```
+
+### Two-Factor Authentication (TOTP)
+
+```ruby
+user = User.find_by(email_address: 'alice@example.com')
+
+# Check if TOTP is enabled
+user.totp_enabled?
+
+# Get current TOTP code (useful for testing/debugging)
+puts user.console_totp
+
+# Enable TOTP (generates secret and backup codes)
+backup_codes = user.enable_totp!
+puts backup_codes  # Display backup codes to give to user
+
+# Disable TOTP
+user.disable_totp!
+
+# Force user to set up TOTP on next login
+user.update!(totp_required: true)
+```
+
+### Managing User Status
+
+```ruby
+user = User.find_by(email_address: 'alice@example.com')
+
+# Disable a user (prevents login)
+user.disabled!
+
+# Re-enable a user
+user.active!
+
+# Check current status
+user.status  # => "active", "disabled", or "pending_invitation"
+
+# Grant admin privileges
+user.update!(admin: true)
+
+# Revoke admin privileges
+user.update!(admin: false)
+```
+
+### Managing Groups
+
+```ruby
+user = User.find_by(email_address: 'alice@example.com')
+
+# View user's groups
+user.groups.pluck(:name)
+
+# Add user to a group
+family = Group.find_by(name: 'family')
+user.groups << family
+
+# Remove user from a group
+user.groups.delete(family)
+
+# Create a new group
+Group.create!(name: 'developers', description: 'Development team')
+```
+
+### Managing Sessions
+
+```ruby
+user = User.find_by(email_address: 'alice@example.com')
+
+# View active sessions
+user.sessions.pluck(:id, :device_name, :client_ip, :created_at)
+
+# Revoke all sessions (force logout everywhere)
+user.sessions.destroy_all
+
+# Revoke a specific session
+user.sessions.find(123).destroy
+```
+
+### Managing Applications
+
+```ruby
+# List all OIDC applications
+Application.oidc.pluck(:name, :client_id)
+
+# Find an application
+app = Application.find_by(slug: 'kavita')
+
+# Regenerate client secret
+new_secret = app.generate_new_client_secret!
+puts new_secret  # Display once - not stored in plain text
+
+# Check which users can access an app
+app.allowed_groups.flat_map(&:users).uniq.pluck(:email_address)
+
+# Revoke all tokens for an application
+app.oidc_access_tokens.destroy_all
+app.oidc_refresh_tokens.destroy_all
+```
+
+### Revoking OIDC Consents
+
+```ruby
+user = User.find_by(email_address: 'alice@example.com')
+app = Application.find_by(slug: 'kavita')
+
+# Revoke consent for a specific app
+user.revoke_consent!(app)
+
+# Revoke all OIDC consents
+user.revoke_all_consents!
+```

 ---

--- a/app/controllers/active_sessions_controller.rb
+++ b/app/controllers/active_sessions_controller.rb
@@ -16,16 +16,82 @@ class ActiveSessionsController < ApplicationController
      return
    end

+    # Send backchannel logout notification before revoking consent
+    if application.supports_backchannel_logout?
+      BackchannelLogoutJob.perform_later(
+        user_id: @user.id,
+        application_id: application.id,
+        consent_sid: consent.sid
+      )
+      Rails.logger.info "ActiveSessionsController: Enqueued backchannel logout for #{application.name}"
+    end
+
+    # Revoke all tokens for this user-application pair
+    now = Time.current
+    revoked_access_tokens = OidcAccessToken.where(application: application, user: @user, revoked_at: nil)
+                                           .update_all(revoked_at: now)
+    revoked_refresh_tokens = OidcRefreshToken.where(application: application, user: @user, revoked_at: nil)
+                                             .update_all(revoked_at: now)
+
+    Rails.logger.info "ActiveSessionsController: Revoked #{revoked_access_tokens} access tokens and #{revoked_refresh_tokens} refresh tokens for #{application.name}"
+
    # Revoke the consent
    consent.destroy
    redirect_to active_sessions_path, notice: "Successfully revoked access to #{application.name}."
  end

+  def logout_from_app
+    @user = Current.session.user
+    application = Application.find(params[:application_id])
+
+    # Check if user has consent for this application
+    consent = @user.oidc_user_consents.find_by(application: application)
+    unless consent
+      redirect_to root_path, alert: "No active session found for this application."
+      return
+    end
+
+    # Send backchannel logout notification
+    if application.supports_backchannel_logout?
+      BackchannelLogoutJob.perform_later(
+        user_id: @user.id,
+        application_id: application.id,
+        consent_sid: consent.sid
+      )
+      Rails.logger.info "ActiveSessionsController: Enqueued backchannel logout for #{application.name}"
+    end
+
+    # Revoke all tokens for this user-application pair
+    now = Time.current
+    revoked_access_tokens = OidcAccessToken.where(application: application, user: @user, revoked_at: nil)
+                                           .update_all(revoked_at: now)
+    revoked_refresh_tokens = OidcRefreshToken.where(application: application, user: @user, revoked_at: nil)
+                                             .update_all(revoked_at: now)
+
+    Rails.logger.info "ActiveSessionsController: Logged out from #{application.name} - revoked #{revoked_access_tokens} access tokens and #{revoked_refresh_tokens} refresh tokens"
+
+    # Keep the consent intact - this is the key difference from revoke_consent
+    redirect_to root_path, notice: "Successfully logged out of #{application.name}."
+  end
+
  def revoke_all_consents
    @user = Current.session.user
-    count = @user.oidc_user_consents.count
+    consents = @user.oidc_user_consents.includes(:application)
+    count = consents.count

    if count > 0
+      # Send backchannel logout notifications before revoking consents
+      consents.each do |consent|
+        next unless consent.application.supports_backchannel_logout?
+
+        BackchannelLogoutJob.perform_later(
+          user_id: @user.id,
+          application_id: consent.application.id,
+          consent_sid: consent.sid
+        )
+      end
+      Rails.logger.info "ActiveSessionsController: Enqueued #{count} backchannel logout notifications"
+
      @user.oidc_user_consents.destroy_all
      redirect_to active_sessions_path, notice: "Successfully revoked access to #{count} applications."
    else
--- a/app/controllers/admin/applications_controller.rb
+++ b/app/controllers/admin/applications_controller.rb
@@ -26,16 +26,17 @@ module Admin
          @application.allowed_groups = Group.where(id: group_ids)
        end

-        # Get the plain text client secret to show one time
+        # Get the plain text client secret to show one time (confidential clients only)
        client_secret = nil
-        if @application.oidc?
+        if @application.oidc? && @application.confidential_client?
          client_secret = @application.generate_new_client_secret!
        end

-        if @application.oidc? && client_secret
+        if @application.oidc?
          flash[:notice] = "Application created successfully."
          flash[:client_id] = @application.client_id
-          flash[:client_secret] = client_secret
+          flash[:client_secret] = client_secret if client_secret
+          flash[:public_client] = true if @application.public_client?
        else
          flash[:notice] = "Application created successfully."
        end
@@ -74,15 +75,20 @@ module Admin

    def regenerate_credentials
      if @application.oidc?
-        # Generate new client ID and secret
+        # Generate new client ID (always)
        new_client_id = SecureRandom.urlsafe_base64(32)
-        client_secret = @application.generate_new_client_secret!
-
        @application.update!(client_id: new_client_id)

        flash[:notice] = "Credentials regenerated successfully."
        flash[:client_id] = @application.client_id
+
+        # Generate new client secret only for confidential clients
+        if @application.confidential_client?
+          client_secret = @application.generate_new_client_secret!
          flash[:client_secret] = client_secret
+        else
+          flash[:public_client] = true
+        end

        redirect_to admin_application_path(@application)
      else
@@ -97,13 +103,24 @@ module Admin
    end

    def application_params
-      params.require(:application).permit(
+      permitted = params.require(:application).permit(
        :name, :slug, :app_type, :active, :redirect_uris, :description, :metadata,
-        :domain_pattern, :landing_url, headers_config: {}
-      ).tap do |whitelisted|
-        # Remove client_secret from params if present (shouldn't be updated via form)
-        whitelisted.delete(:client_secret)
+        :domain_pattern, :landing_url, :access_token_ttl, :refresh_token_ttl, :id_token_ttl,
+        :icon, :backchannel_logout_uri, :is_public_client, :require_pkce
+      )
+
+      # Handle headers_config - it comes as a JSON string from the text area
+      if params[:application][:headers_config].present?
+        begin
+          permitted[:headers_config] = JSON.parse(params[:application][:headers_config])
+        rescue JSON::ParserError
+          permitted[:headers_config] = {}
        end
      end
+
+      # Remove client_secret from params if present (shouldn't be updated via form)
+      permitted.delete(:client_secret)
+      permitted
+    end
  end
 end
--- a/app/controllers/admin/groups_controller.rb
+++ b/app/controllers/admin/groups_controller.rb
@@ -18,7 +18,25 @@ module Admin
    end

    def create
-      @group = Group.new(group_params)
+      create_params = group_params
+
+      # Parse custom_claims JSON if provided
+      if create_params[:custom_claims].present?
+        begin
+          create_params[:custom_claims] = JSON.parse(create_params[:custom_claims])
+        rescue JSON::ParserError
+          @group = Group.new
+          @group.errors.add(:custom_claims, "must be valid JSON")
+          @available_users = User.order(:email_address)
+          render :new, status: :unprocessable_entity
+          return
+        end
+      else
+        # If empty or blank, set to empty hash (NOT NULL constraint)
+        create_params[:custom_claims] = {}
+      end
+
+      @group = Group.new(create_params)

      if @group.save
        # Handle user assignments
@@ -39,7 +57,24 @@ module Admin
    end

    def update
-      if @group.update(group_params)
+      update_params = group_params
+
+      # Parse custom_claims JSON if provided
+      if update_params[:custom_claims].present?
+        begin
+          update_params[:custom_claims] = JSON.parse(update_params[:custom_claims])
+        rescue JSON::ParserError
+          @group.errors.add(:custom_claims, "must be valid JSON")
+          @available_users = User.order(:email_address)
+          render :edit, status: :unprocessable_entity
+          return
+        end
+      else
+        # If empty or blank, set to empty hash (NOT NULL constraint)
+        update_params[:custom_claims] = {}
+      end
+
+      if @group.update(update_params)
        # Handle user assignments
        if params[:group][:user_ids].present?
          user_ids = params[:group][:user_ids].reject(&:blank?)
@@ -67,7 +102,7 @@ module Admin
    end

    def group_params
-      params.require(:group).permit(:name, :description, custom_claims: {})
+      params.require(:group).permit(:name, :description, :custom_claims)
    end
  end
 end
--- a/app/controllers/admin/users_controller.rb
+++ b/app/controllers/admin/users_controller.rb
@@ -1,6 +1,6 @@
 module Admin
  class UsersController < BaseController
-    before_action :set_user, only: [:show, :edit, :update, :destroy, :resend_invitation]
+    before_action :set_user, only: [:show, :edit, :update, :destroy, :resend_invitation, :update_application_claims, :delete_application_claims]

    def index
      @users = User.order(created_at: :desc)
@@ -27,23 +27,34 @@ module Admin
    end

    def edit
+      @applications = Application.active.order(:name)
    end

    def update
-      # Prevent changing params for the current user's email and admin status
-      # to avoid locking themselves out
-      update_params = user_params.dup
-
-      if @user == Current.session.user
-        update_params.delete(:admin)
-      end
+      update_params = user_params

      # Only update password if provided
      update_params.delete(:password) if update_params[:password].blank?

+      # Parse custom_claims JSON if provided
+      if update_params[:custom_claims].present?
+        begin
+          update_params[:custom_claims] = JSON.parse(update_params[:custom_claims])
+        rescue JSON::ParserError
+          @user.errors.add(:custom_claims, "must be valid JSON")
+          @applications = Application.active.order(:name)
+          render :edit, status: :unprocessable_entity
+          return
+        end
+      else
+        # If empty or blank, set to empty hash (NOT NULL constraint)
+        update_params[:custom_claims] = {}
+      end
+
      if @user.update(update_params)
        redirect_to admin_users_path, notice: "User updated successfully."
      else
+        @applications = Application.active.order(:name)
        render :edit, status: :unprocessable_entity
      end
    end
@@ -69,6 +80,41 @@ module Admin
      redirect_to admin_users_path, notice: "User deleted successfully."
    end

+    # POST /admin/users/:id/update_application_claims
+    def update_application_claims
+      application = Application.find(params[:application_id])
+
+      claims_json = params[:custom_claims].presence || "{}"
+      begin
+        claims = JSON.parse(claims_json)
+      rescue JSON::ParserError
+        redirect_to edit_admin_user_path(@user), alert: "Invalid JSON format for claims."
+        return
+      end
+
+      app_claim = @user.application_user_claims.find_or_initialize_by(application: application)
+      app_claim.custom_claims = claims
+
+      if app_claim.save
+        redirect_to edit_admin_user_path(@user), notice: "App-specific claims updated for #{application.name}."
+      else
+        error_message = app_claim.errors.full_messages.join(", ")
+        redirect_to edit_admin_user_path(@user), alert: "Failed to update claims: #{error_message}"
+      end
+    end
+
+    # DELETE /admin/users/:id/delete_application_claims
+    def delete_application_claims
+      application = Application.find(params[:application_id])
+      app_claim = @user.application_user_claims.find_by(application: application)
+
+      if app_claim&.destroy
+        redirect_to edit_admin_user_path(@user), notice: "App-specific claims removed for #{application.name}."
+      else
+        redirect_to edit_admin_user_path(@user), alert: "No claims found to remove."
+      end
+    end
+
    private

    def set_user
@@ -76,7 +122,15 @@ module Admin
    end

    def user_params
-      params.require(:user).permit(:email_address, :name, :password, :admin, :status, custom_claims: {})
+      # Base attributes that all admins can modify
+      base_params = params.require(:user).permit(:email_address, :username, :name, :password, :status, :totp_required, :custom_claims)
+
+      # Only allow modifying admin status when editing other users (prevent self-demotion)
+      if params[:id] != Current.session.user.id.to_s
+        base_params[:admin] = params[:user][:admin] if params[:user][:admin].present?
+      end
+
+      base_params
    end
  end
 end
--- a/app/controllers/api/csp_controller.rb
+++ b/app/controllers/api/csp_controller.rb
@@ -10,6 +10,13 @@ module Api
      report_data = JSON.parse(request.body.read)
      csp_report = report_data['csp-report']

+      # Validate that we have a proper CSP report
+      unless csp_report.is_a?(Hash) && csp_report.present?
+        Rails.logger.warn "Received empty or invalid CSP violation report"
+        head :bad_request
+        return
+      end
+
      # Log the violation for security monitoring
      Rails.logger.warn "CSP Violation Report:"
      Rails.logger.warn "  Blocked URI: #{csp_report['blocked-uri']}"
--- a/app/controllers/api/forward_auth_controller.rb
+++ b/app/controllers/api/forward_auth_controller.rb
@@ -3,7 +3,7 @@ module Api
    # ForwardAuth endpoints need session storage for return URL
    allow_unauthenticated_access
    skip_before_action :verify_authenticity_token
-    rate_limit to: 100, within: 1.minute, only: :verify, with: -> { head :too_many_requests }
+    # No rate limiting on forward_auth endpoint - proxy middleware hits this frequently

    # GET /api/verify
    # This endpoint is called by reverse proxies (Traefik, Caddy, nginx)
@@ -49,14 +49,20 @@ module Api
      forwarded_host = request.headers["X-Forwarded-Host"] || request.headers["Host"]

      if forwarded_host.present?
-        # Load active forward auth applications with their associations for better performance
+        # Load all forward auth applications (including inactive ones) for security checks
        # Preload groups to avoid N+1 queries in user_allowed? checks
-        apps = Application.forward_auth.includes(:allowed_groups).active
+        apps = Application.forward_auth.includes(:allowed_groups)

        # Find matching forward auth application for this domain
        app = apps.find { |a| a.matches_domain?(forwarded_host) }

        if app
+          # Check if application is active
+          unless app.active?
+            Rails.logger.info "ForwardAuth: Access denied to #{forwarded_host} - application is inactive"
+            return render_forbidden("No authentication rule configured for this domain")
+          end
+
          # Check if user is allowed by this application
          unless app.user_allowed?(user)
            Rails.logger.info "ForwardAuth: User #{user.email_address} denied access to #{forwarded_host} by app #{app.domain_pattern}"
@@ -65,8 +71,9 @@ module Api

          Rails.logger.info "ForwardAuth: User #{user.email_address} granted access to #{forwarded_host} by app #{app.domain_pattern} (policy: #{app.policy_for_user(user)})"
        else
-          # No application found - allow access with default headers (original behavior)
-          Rails.logger.info "ForwardAuth: No application found for domain: #{forwarded_host}, allowing with default headers"
+          # No application found - DENY by default (fail-closed security)
+          Rails.logger.info "ForwardAuth: Access denied to #{forwarded_host} - no authentication rule configured"
+          return render_forbidden("No authentication rule configured for this domain")
        end
      else
        Rails.logger.info "ForwardAuth: User #{user.email_address} authenticated (no domain specified)"
@@ -135,6 +142,9 @@ module Api
    def render_unauthorized(reason = nil)
      Rails.logger.info "ForwardAuth: Unauthorized - #{reason}"

+      # Set auth reason header for debugging (like Authelia)
+      response.headers["X-Auth-Reason"] = reason if reason.present?
+
      # Get the redirect URL from query params or construct default
      redirect_url = validate_redirect_url(params[:rd])
      base_url = determine_base_url(redirect_url)
@@ -176,6 +186,9 @@ module Api
    def render_forbidden(reason = nil)
      Rails.logger.info "ForwardAuth: Forbidden - #{reason}"

+      # Set auth reason header for debugging (like Authelia)
+      response.headers["X-Auth-Reason"] = reason if reason.present?
+
      # Return 403 Forbidden
      head :forbidden
    end
@@ -221,7 +234,9 @@ module Api

      # Try CLINCH_HOST environment variable first
      if ENV['CLINCH_HOST'].present?
-        "https://#{ENV['CLINCH_HOST']}"
+        host = ENV['CLINCH_HOST']
+        # Ensure URL has https:// protocol
+        host.match?(/^https?:\/\//) ? host : "https://#{host}"
      else
        # Fallback to the request host
        request_host = request.host || request.headers['X-Forwarded-Host']
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -5,4 +5,7 @@ class ApplicationController < ActionController::Base

  # Changes to the importmap will invalidate the etag for HTML responses
  stale_when_importmap_changes
+
+  # CSRF protection
+  protect_from_forgery with: :exception
 end
--- a/app/controllers/concerns/authentication.rb
+++ b/app/controllers/concerns/authentication.rb
@@ -120,11 +120,11 @@ module Authentication
      # Generate a secure random token
      token = SecureRandom.urlsafe_base64(32)

-      # Store it with an expiry of 30 seconds
+      # Store it with an expiry of 60 seconds
      Rails.cache.write(
        "forward_auth_token:#{token}",
        session_obj.id,
-        expires_in: 30.seconds
+        expires_in: 60.seconds
      )

      # Set the token as a query parameter on the redirect URL
@@ -134,6 +134,8 @@ module Authentication
        original_url = controller_session[:return_to_after_authenticating]
        uri = URI.parse(original_url)

+        # Skip adding fa_token for OAuth URLs (OAuth flow should not have forward auth tokens)
+        unless uri.path&.start_with?("/oauth/")
          # Add token as query parameter
          query_params = URI.decode_www_form(uri.query || "").to_h
          query_params['fa_token'] = token
@@ -143,4 +145,5 @@ module Authentication
          controller_session[:return_to_after_authenticating] = uri.to_s
        end
      end
+    end
 end
--- a/app/controllers/oidc_controller.rb
+++ b/app/controllers/oidc_controller.rb
@@ -1,7 +1,15 @@
 class OidcController < ApplicationController
  # Discovery and JWKS endpoints are public
-  allow_unauthenticated_access only: [:discovery, :jwks, :token, :userinfo, :logout]
-  skip_before_action :verify_authenticity_token, only: [:token, :logout]
+  allow_unauthenticated_access only: [:discovery, :jwks, :token, :revoke, :userinfo, :logout]
+  skip_before_action :verify_authenticity_token, only: [:token, :revoke, :logout]
+
+  # Rate limiting to prevent brute force and abuse
+  rate_limit to: 60, within: 1.minute, only: [:token, :revoke], with: -> {
+    render json: { error: "too_many_requests", error_description: "Rate limit exceeded. Try again later." }, status: :too_many_requests
+  }
+  rate_limit to: 30, within: 1.minute, only: [:authorize, :consent], with: -> {
+    render plain: "Too many authorization attempts. Try again later.", status: :too_many_requests
+  }

  # GET /.well-known/openid-configuration
  def discovery
@@ -11,15 +19,21 @@ class OidcController < ApplicationController
      issuer: base_url,
      authorization_endpoint: "#{base_url}/oauth/authorize",
      token_endpoint: "#{base_url}/oauth/token",
+      revocation_endpoint: "#{base_url}/oauth/revoke",
      userinfo_endpoint: "#{base_url}/oauth/userinfo",
      jwks_uri: "#{base_url}/.well-known/jwks.json",
      end_session_endpoint: "#{base_url}/logout",
      response_types_supported: ["code"],
-      subject_types_supported: ["public"],
+      response_modes_supported: ["query"],
+      grant_types_supported: ["authorization_code", "refresh_token"],
+      subject_types_supported: ["pairwise"],
      id_token_signing_alg_values_supported: ["RS256"],
-      scopes_supported: ["openid", "profile", "email", "groups"],
+      scopes_supported: ["openid", "profile", "email", "groups", "offline_access"],
      token_endpoint_auth_methods_supported: ["client_secret_post", "client_secret_basic"],
-      claims_supported: ["sub", "email", "email_verified", "name", "preferred_username", "groups", "admin"]
+      claims_supported: ["sub", "email", "email_verified", "name", "preferred_username", "groups", "admin"],
+      code_challenge_methods_supported: ["plain", "S256"],
+      backchannel_logout_supported: true,
+      backchannel_logout_session_supported: true
    }

    render json: config
@@ -32,30 +46,80 @@ class OidcController < ApplicationController

  # GET /oauth/authorize
  def authorize
-    # Get parameters
+    # Get parameters (ignore forward auth tokens and other unknown params)
    client_id = params[:client_id]
    redirect_uri = params[:redirect_uri]
    state = params[:state]
    nonce = params[:nonce]
    scope = params[:scope] || "openid"
    response_type = params[:response_type]
+    code_challenge = params[:code_challenge]
+    code_challenge_method = params[:code_challenge_method] || "plain"

    # Validate required parameters
    unless client_id.present? && redirect_uri.present? && response_type == "code"
-      render plain: "Invalid request: missing required parameters", status: :bad_request
+      error_details = []
+      error_details << "client_id is required" unless client_id.present?
+      error_details << "redirect_uri is required" unless redirect_uri.present?
+      error_details << "response_type must be 'code'" unless response_type == "code"
+
+      render plain: "Invalid request: #{error_details.join(', ')}", status: :bad_request
      return
    end

+    # Validate PKCE parameters if present
+    if code_challenge.present?
+      unless %w[plain S256].include?(code_challenge_method)
+        render plain: "Invalid code_challenge_method: must be 'plain' or 'S256'", status: :bad_request
+        return
+      end
+
+      # Validate code challenge format (base64url-encoded, 43-128 characters)
+      unless code_challenge.match?(/\A[A-Za-z0-9\-_]{43,128}\z/)
+        render plain: "Invalid code_challenge format: must be 43-128 characters of base64url encoding", status: :bad_request
+        return
+      end
+    end
+
    # Find the application
    @application = Application.find_by(client_id: client_id, app_type: "oidc")
    unless @application
-      render plain: "Invalid client_id", status: :bad_request
+      # Log all OIDC applications for debugging
+      all_oidc_apps = Application.where(app_type: "oidc")
+      Rails.logger.error "OAuth: Invalid request - application not found for client_id: #{client_id}"
+      Rails.logger.error "OAuth: Available OIDC applications: #{all_oidc_apps.pluck(:id, :client_id, :name)}"
+
+      error_msg = if Rails.env.development?
+        "Invalid request: Application not found for client_id '#{client_id}'. Available OIDC applications: #{all_oidc_apps.pluck(:name, :client_id).map { |name, id| "#{name} (#{id})" }.join(', ')}"
+      else
+        "Invalid request: Application not found"
+      end
+
+      render plain: error_msg, status: :bad_request
      return
    end

-    # Validate redirect URI
+    # Validate redirect URI first (required before we can safely redirect with errors)
    unless @application.parsed_redirect_uris.include?(redirect_uri)
-      render plain: "Invalid redirect_uri", status: :bad_request
+      Rails.logger.error "OAuth: Invalid request - redirect URI mismatch. Expected: #{@application.parsed_redirect_uris}, Got: #{redirect_uri}"
+
+      # For development, show detailed error
+      error_msg = if Rails.env.development?
+        "Invalid request: Redirect URI mismatch. Application is configured for: #{@application.parsed_redirect_uris.join(', ')}, but received: #{redirect_uri}"
+      else
+        "Invalid request: Redirect URI not registered for this application"
+      end
+
+      render plain: error_msg, status: :bad_request
+      return
+    end
+
+    # Check if application is active (now we can safely redirect with error)
+    unless @application.active?
+      Rails.logger.error "OAuth: Application is not active: #{@application.name}"
+      error_uri = "#{redirect_uri}?error=unauthorized_client&error_description=Application+is+not+active"
+      error_uri += "&state=#{CGI.escape(state)}" if state.present?
+      redirect_to error_uri, allow_other_host: true
      return
    end

@@ -67,7 +131,9 @@ class OidcController < ApplicationController
        redirect_uri: redirect_uri,
        state: state,
        nonce: nonce,
-        scope: scope
+        scope: scope,
+        code_challenge: code_challenge,
+        code_challenge_method: code_challenge_method
      }
      redirect_to signin_path, alert: "Please sign in to continue"
      return
@@ -96,12 +162,14 @@ class OidcController < ApplicationController
        redirect_uri: redirect_uri,
        scope: scope,
        nonce: nonce,
+        code_challenge: code_challenge,
+        code_challenge_method: code_challenge_method,
        expires_at: 10.minutes.from_now
      )

      # Redirect back to client with authorization code
      redirect_uri = "#{redirect_uri}?code=#{code}"
-      redirect_uri += "&state=#{state}" if state.present?
+      redirect_uri += "&state=#{CGI.escape(state)}" if state.present?
      redirect_to redirect_uri, allow_other_host: true
      return
    end
@@ -112,12 +180,34 @@ class OidcController < ApplicationController
      redirect_uri: redirect_uri,
      state: state,
      nonce: nonce,
-      scope: scope
+      scope: scope,
+      code_challenge: code_challenge,
+      code_challenge_method: code_challenge_method
    }

-    # Render consent page
+    # Render consent page with dynamic CSP for OAuth redirect
    @redirect_uri = redirect_uri
    @scopes = requested_scopes
+
+    # Add the redirect URI to CSP form-action for this specific request
+    # This allows the OAuth redirect to work while maintaining security
+    # CSP must allow the OAuth client's redirect_uri as a form submission target
+    if redirect_uri.present?
+      begin
+        redirect_host = URI.parse(redirect_uri).host
+        csp = request.content_security_policy
+        if csp && redirect_host
+          # Only modify if form_action is available and mutable
+          if csp.respond_to?(:form_action) && csp.form_action.respond_to?(:<<)
+            csp.form_action << "https://#{redirect_host}"
+          end
+        end
+      rescue => e
+        # Log CSP modification errors but don't fail the request
+        Rails.logger.warn "OAuth: Could not modify CSP for redirect_uri #{redirect_uri}: #{e.message}"
+      end
+    end
+
    render :consent
  end

@@ -134,7 +224,7 @@ class OidcController < ApplicationController
    if params[:deny].present?
      session.delete(:oauth_params)
      error_uri = "#{oauth_params['redirect_uri']}?error=access_denied"
-      error_uri += "&state=#{oauth_params['state']}" if oauth_params['state']
+      error_uri += "&state=#{CGI.escape(oauth_params['state'])}" if oauth_params['state']
      redirect_to error_uri, allow_other_host: true
      return
    end
@@ -142,6 +232,17 @@ class OidcController < ApplicationController
    # Find the application
    client_id = oauth_params['client_id']
    application = Application.find_by(client_id: client_id, app_type: "oidc")
+
+    # Check if application is active (redirect with OAuth error)
+    unless application&.active?
+      Rails.logger.error "OAuth: Application is not active: #{application&.name || client_id}"
+      session.delete(:oauth_params)
+      error_uri = "#{oauth_params['redirect_uri']}?error=unauthorized_client&error_description=Application+is+not+active"
+      error_uri += "&state=#{CGI.escape(oauth_params['state'])}" if oauth_params['state'].present?
+      redirect_to error_uri, allow_other_host: true
+      return
+    end
+
    user = Current.session.user

    # Record user consent
@@ -165,6 +266,8 @@ class OidcController < ApplicationController
      redirect_uri: oauth_params['redirect_uri'],
      scope: oauth_params['scope'],
      nonce: oauth_params['nonce'],
+      code_challenge: oauth_params['code_challenge'],
+      code_challenge_method: oauth_params['code_challenge_method'],
      expires_at: 10.minutes.from_now
    )

@@ -173,7 +276,7 @@ class OidcController < ApplicationController

    # Redirect back to client with authorization code
    redirect_uri = "#{oauth_params['redirect_uri']}?code=#{code}"
-    redirect_uri += "&state=#{oauth_params['state']}" if oauth_params['state']
+    redirect_uri += "&state=#{CGI.escape(oauth_params['state'])}" if oauth_params['state']

    redirect_to redirect_uri, allow_other_host: true
  end
@@ -182,34 +285,59 @@ class OidcController < ApplicationController
  def token
    grant_type = params[:grant_type]

-    unless grant_type == "authorization_code"
+    case grant_type
+    when "authorization_code"
+      handle_authorization_code_grant
+    when "refresh_token"
+      handle_refresh_token_grant
+    else
      render json: { error: "unsupported_grant_type" }, status: :bad_request
-      return
+    end
  end

+  def handle_authorization_code_grant
    # Get client credentials from Authorization header or params
    client_id, client_secret = extract_client_credentials

-    unless client_id && client_secret
-      render json: { error: "invalid_client" }, status: :unauthorized
+    unless client_id
+      render json: { error: "invalid_client", error_description: "client_id is required" }, status: :unauthorized
      return
    end

-    # Find and validate the application
+    # Find the application
    application = Application.find_by(client_id: client_id)
-    unless application && application.authenticate_client_secret(client_secret)
-      render json: { error: "invalid_client" }, status: :unauthorized
+    unless application
+      render json: { error: "invalid_client", error_description: "Unknown client" }, status: :unauthorized
+      return
+    end
+
+    # Validate client credentials based on client type
+    if application.public_client?
+      # Public clients don't have a secret - they MUST use PKCE (checked later)
+      Rails.logger.info "OAuth: Public client authentication for #{application.name}"
+    else
+      # Confidential clients MUST provide valid client_secret
+      unless client_secret.present? && application.authenticate_client_secret(client_secret)
+        render json: { error: "invalid_client", error_description: "Invalid client credentials" }, status: :unauthorized
+        return
+      end
+    end
+
+    # Check if application is active
+    unless application.active?
+      Rails.logger.error "OAuth: Token request for inactive application: #{application.name}"
+      render json: { error: "invalid_client", error_description: "Application is not active" }, status: :forbidden
      return
    end

    # Get the authorization code
    code = params[:code]
    redirect_uri = params[:redirect_uri]
+    code_verifier = params[:code_verifier]

    auth_code = OidcAuthorizationCode.find_by(
      application: application,
-      code: code,
-      used: false
+      code: code
    )

    unless auth_code
@@ -217,6 +345,31 @@ class OidcController < ApplicationController
      return
    end

+    # Use a transaction with pessimistic locking to prevent code reuse
+    begin
+      OidcAuthorizationCode.transaction do
+        # Lock the record to prevent concurrent access
+        auth_code.lock!
+
+        # Check if code has already been used (CRITICAL: check AFTER locking)
+        if auth_code.used?
+          # Per OAuth 2.0 spec, if an auth code is reused, revoke all tokens issued from it
+          Rails.logger.warn "OAuth Security: Authorization code reuse detected for code #{auth_code.id}"
+
+          # Revoke all access tokens issued from this authorization code
+          OidcAccessToken.where(
+            application: application,
+            user: auth_code.user,
+            created_at: auth_code.created_at..Time.current
+          ).update_all(expires_at: Time.current)
+
+          render json: {
+            error: "invalid_grant",
+            error_description: "Authorization code has already been used"
+          }, status: :bad_request
+          return
+        end
+
        # Check if code is expired
        if auth_code.expires_at < Time.current
          render json: { error: "invalid_grant", error_description: "Authorization code expired" }, status: :bad_request
@@ -229,34 +382,189 @@ class OidcController < ApplicationController
          return
        end

-    # Mark code as used
+        # Validate PKCE - required for public clients and optionally for confidential clients
+        pkce_result = validate_pkce(application, auth_code, code_verifier)
+        unless pkce_result[:valid]
+          render json: {
+            error: pkce_result[:error],
+            error_description: pkce_result[:error_description]
+          }, status: pkce_result[:status]
+          return
+        end
+
+        # Mark code as used BEFORE generating tokens (prevents reuse)
        auth_code.update!(used: true)

        # Get the user
        user = auth_code.user

-    # Generate access token
-    access_token = SecureRandom.urlsafe_base64(32)
-    OidcAccessToken.create!(
+        # Generate access token record (opaque token with BCrypt hashing)
+        access_token_record = OidcAccessToken.create!(
          application: application,
          user: user,
-      token: access_token,
-      scope: auth_code.scope,
-      expires_at: 1.hour.from_now
+          scope: auth_code.scope
        )

-    # Generate ID token
-    id_token = OidcJwtService.generate_id_token(user, application, nonce: auth_code.nonce)
+        # Generate refresh token (opaque, with hashing)
+        refresh_token_record = OidcRefreshToken.create!(
+          application: application,
+          user: user,
+          oidc_access_token: access_token_record,
+          scope: auth_code.scope
+        )
+
+        # Find user consent for this application
+        consent = OidcUserConsent.find_by(user: user, application: application)
+
+        unless consent
+          Rails.logger.error "OIDC Security: Token requested without consent record (user: #{user.id}, app: #{application.id})"
+          render json: { error: "invalid_grant", error_description: "Authorization consent not found" }, status: :bad_request
+          return
+        end
+
+        # Generate ID token (JWT) with pairwise SID and at_hash
+        id_token = OidcJwtService.generate_id_token(
+          user,
+          application,
+          consent: consent,
+          nonce: auth_code.nonce,
+          access_token: access_token_record.plaintext_token
+        )

        # Return tokens
        render json: {
-      access_token: access_token,
+          access_token: access_token_record.plaintext_token,  # Opaque token
          token_type: "Bearer",
-      expires_in: 3600,
-      id_token: id_token,
+          expires_in: application.access_token_ttl || 3600,
+          id_token: id_token,  # JWT
+          refresh_token: refresh_token_record.token,  # Opaque token
          scope: auth_code.scope
        }
      end
+    rescue ActiveRecord::RecordNotFound
+      render json: { error: "invalid_grant" }, status: :bad_request
+    end
+  end
+
+  def handle_refresh_token_grant
+    # Get client credentials from Authorization header or params
+    client_id, client_secret = extract_client_credentials
+
+    unless client_id
+      render json: { error: "invalid_client", error_description: "client_id is required" }, status: :unauthorized
+      return
+    end
+
+    # Find the application
+    application = Application.find_by(client_id: client_id)
+    unless application
+      render json: { error: "invalid_client", error_description: "Unknown client" }, status: :unauthorized
+      return
+    end
+
+    # Validate client credentials based on client type
+    if application.public_client?
+      # Public clients don't have a secret
+      Rails.logger.info "OAuth: Public client refresh token request for #{application.name}"
+    else
+      # Confidential clients MUST provide valid client_secret
+      unless client_secret.present? && application.authenticate_client_secret(client_secret)
+        render json: { error: "invalid_client", error_description: "Invalid client credentials" }, status: :unauthorized
+        return
+      end
+    end
+
+    # Check if application is active
+    unless application.active?
+      Rails.logger.error "OAuth: Refresh token request for inactive application: #{application.name}"
+      render json: { error: "invalid_client", error_description: "Application is not active" }, status: :forbidden
+      return
+    end
+
+    # Get the refresh token
+    refresh_token = params[:refresh_token]
+    unless refresh_token.present?
+      render json: { error: "invalid_request", error_description: "refresh_token is required" }, status: :bad_request
+      return
+    end
+
+    # Find the refresh token record using indexed token prefix lookup
+    refresh_token_record = OidcRefreshToken.find_by_token(refresh_token)
+
+    # Verify the token belongs to the correct application
+    unless refresh_token_record && refresh_token_record.application == application
+      render json: { error: "invalid_grant", error_description: "Invalid refresh token" }, status: :bad_request
+      return
+    end
+
+    # Check if refresh token is expired
+    if refresh_token_record.expired?
+      render json: { error: "invalid_grant", error_description: "Refresh token expired" }, status: :bad_request
+      return
+    end
+
+    # Check if refresh token is revoked
+    if refresh_token_record.revoked?
+      # If a revoked refresh token is used, it's a security issue
+      # Revoke all tokens in the family (token rotation attack detection)
+      Rails.logger.warn "OAuth Security: Revoked refresh token reuse detected for token family #{refresh_token_record.token_family_id}"
+      refresh_token_record.revoke_family!
+
+      render json: { error: "invalid_grant", error_description: "Refresh token has been revoked" }, status: :bad_request
+      return
+    end
+
+    # Get the user
+    user = refresh_token_record.user
+
+    # Revoke the old refresh token (token rotation)
+    refresh_token_record.revoke!
+
+    # Generate new access token record (opaque token with BCrypt hashing)
+    new_access_token = OidcAccessToken.create!(
+      application: application,
+      user: user,
+      scope: refresh_token_record.scope
+    )
+
+    # Generate new refresh token (token rotation)
+    new_refresh_token = OidcRefreshToken.create!(
+      application: application,
+      user: user,
+      oidc_access_token: new_access_token,
+      scope: refresh_token_record.scope,
+      token_family_id: refresh_token_record.token_family_id  # Keep same family for rotation tracking
+    )
+
+    # Find user consent for this application
+    consent = OidcUserConsent.find_by(user: user, application: application)
+
+    unless consent
+      Rails.logger.error "OIDC Security: Refresh token used without consent record (user: #{user.id}, app: #{application.id})"
+      render json: { error: "invalid_grant", error_description: "Authorization consent not found" }, status: :bad_request
+      return
+    end
+
+    # Generate new ID token (JWT with pairwise SID and at_hash, no nonce for refresh grants)
+    id_token = OidcJwtService.generate_id_token(
+      user,
+      application,
+      consent: consent,
+      access_token: new_access_token.plaintext_token
+    )
+
+    # Return new tokens
+    render json: {
+      access_token: new_access_token.plaintext_token,  # Opaque token
+      token_type: "Bearer",
+      expires_in: application.access_token_ttl || 3600,
+      id_token: id_token,  # JWT
+      refresh_token: new_refresh_token.token,  # Opaque token
+      scope: refresh_token_record.scope
+    }
+  rescue ActiveRecord::RecordNotFound
+    render json: { error: "invalid_grant" }, status: :bad_request
+  end

  # GET /oauth/userinfo
  def userinfo
@@ -267,27 +575,36 @@ class OidcController < ApplicationController
      return
    end

-    access_token = auth_header.sub("Bearer ", "")
+    token = auth_header.sub("Bearer ", "")

-    # Find the access token
-    token_record = OidcAccessToken.find_by(token: access_token)
-    unless token_record
+    # Find and validate access token (opaque token with BCrypt hashing)
+    access_token = OidcAccessToken.find_by_token(token)
+    unless access_token&.active?
      head :unauthorized
      return
    end

-    # Check if token is expired
-    if token_record.expires_at < Time.current
+    # Check if application is active (immediate cutoff when app is disabled)
+    unless access_token.application&.active?
+      Rails.logger.warn "OAuth: Userinfo request for inactive application: #{access_token.application&.name}"
+      head :forbidden
+      return
+    end
+
+    # Get the user (with fresh data from database)
+    user = access_token.user
+    unless user
      head :unauthorized
      return
    end

-    # Get the user
-    user = token_record.user
+    # Find user consent for this application to get pairwise SID
+    consent = OidcUserConsent.find_by(user: user, application: access_token.application)
+    subject = consent&.sid || user.id.to_s

    # Return user claims
    claims = {
-      sub: user.id.to_s,
+      sub: subject,
      email: user.email_address,
      email_verified: true,
      preferred_username: user.email_address,
@@ -299,9 +616,6 @@ class OidcController < ApplicationController
      claims[:groups] = user.groups.pluck(:name)
    end

-    # Add admin claim if user is admin
-    claims[:admin] = true if user.admin?
-
    # Merge custom claims from groups
    user.groups.each do |group|
      claims.merge!(group.parsed_custom_claims)
@@ -310,9 +624,83 @@ class OidcController < ApplicationController
    # Merge custom claims from user (overrides group claims)
    claims.merge!(user.parsed_custom_claims)

+    # Merge app-specific custom claims (highest priority)
+    application = access_token.application
+    claims.merge!(application.custom_claims_for_user(user))
+
    render json: claims
  end

+  # POST /oauth/revoke
+  # RFC 7009 - Token Revocation
+  def revoke
+    # Get client credentials
+    client_id, client_secret = extract_client_credentials
+
+    unless client_id && client_secret
+      # RFC 7009 says we should return 200 OK even for invalid client
+      # But log the attempt for security monitoring
+      Rails.logger.warn "OAuth: Token revocation attempted with invalid client credentials"
+      head :ok
+      return
+    end
+
+    # Find and validate the application
+    application = Application.find_by(client_id: client_id)
+    unless application && application.authenticate_client_secret(client_secret)
+      Rails.logger.warn "OAuth: Token revocation attempted for invalid application: #{client_id}"
+      head :ok
+      return
+    end
+
+    # Check if application is active (RFC 7009: still return 200 OK for privacy)
+    unless application.active?
+      Rails.logger.warn "OAuth: Token revocation attempted for inactive application: #{application.name}"
+      head :ok
+      return
+    end
+
+    # Get the token to revoke
+    token = params[:token]
+    token_type_hint = params[:token_type_hint]  # Optional hint: "access_token" or "refresh_token"
+
+    unless token.present?
+      # RFC 7009: Missing token parameter is an error
+      render json: { error: "invalid_request", error_description: "token parameter is required" }, status: :bad_request
+      return
+    end
+
+    # Try to find and revoke the token
+    # Check token type hint first for efficiency, otherwise try both
+    revoked = false
+
+    if token_type_hint == "refresh_token" || token_type_hint.nil?
+      # Try to find as refresh token
+      refresh_token_record = OidcRefreshToken.find_by_token(token)
+
+      if refresh_token_record
+        refresh_token_record.revoke!
+        Rails.logger.info "OAuth: Refresh token revoked for application #{application.name}"
+        revoked = true
+      end
+    end
+
+    if !revoked && (token_type_hint == "access_token" || token_type_hint.nil?)
+      # Try to find as access token
+      access_token_record = OidcAccessToken.find_by_token(token)
+
+      if access_token_record
+        access_token_record.revoke!
+        Rails.logger.info "OAuth: Access token revoked for application #{application.name}"
+        revoked = true
+      end
+    end
+
+    # RFC 7009: Always return 200 OK, even if token was not found
+    # This prevents token scanning attacks
+    head :ok
+  end
+
  # GET /logout
  def logout
    # OpenID Connect RP-Initiated Logout
@@ -324,16 +712,29 @@ class OidcController < ApplicationController

    # If user is authenticated, log them out
    if authenticated?
+      user = Current.session.user
+
+      # Send backchannel logout notifications to all connected applications
+      send_backchannel_logout_notifications(user)
+
      # Invalidate the current session
      Current.session&.destroy
      reset_session
    end

-    # If post_logout_redirect_uri is provided, redirect there
+    # If post_logout_redirect_uri is provided, validate and redirect
    if post_logout_redirect_uri.present?
-      redirect_uri = post_logout_redirect_uri
-      redirect_uri += "?state=#{state}" if state.present?
+      validated_uri = validate_logout_redirect_uri(post_logout_redirect_uri)
+
+      if validated_uri
+        redirect_uri = validated_uri
+        redirect_uri += "?state=#{CGI.escape(state)}" if state.present?
        redirect_to redirect_uri, allow_other_host: true
+      else
+        # Invalid redirect URI - log warning and go to default
+        Rails.logger.warn "OIDC Logout: Invalid post_logout_redirect_uri attempted: #{post_logout_redirect_uri}"
+        redirect_to root_path
+      end
    else
      # Default redirect to home page
      redirect_to root_path
@@ -342,6 +743,73 @@ class OidcController < ApplicationController

  private

+  def validate_pkce(application, auth_code, code_verifier)
+    # Check if PKCE is required for this application
+    pkce_required = application.requires_pkce?
+    pkce_provided = auth_code.code_challenge.present?
+
+    # If PKCE is required but wasn't provided during authorization
+    if pkce_required && !pkce_provided
+      client_type = application.public_client? ? "public clients" : "this application"
+      return {
+        valid: false,
+        error: "invalid_request",
+        error_description: "PKCE is required for #{client_type}. code_challenge must be provided during authorization.",
+        status: :bad_request
+      }
+    end
+
+    # Skip validation if no code challenge was stored (legacy clients without PKCE requirement)
+    return { valid: true } unless pkce_provided
+
+    # PKCE was provided during authorization but no verifier sent with token request
+    unless code_verifier.present?
+      return {
+        valid: false,
+        error: "invalid_request",
+        error_description: "code_verifier is required when code_challenge was provided",
+        status: :bad_request
+      }
+    end
+
+    # Validate code verifier format (base64url-encoded, 43-128 characters)
+    unless code_verifier.match?(/\A[A-Za-z0-9\-_]{43,128}\z/)
+      return {
+        valid: false,
+        error: "invalid_request",
+        error_description: "Invalid code_verifier format. Must be 43-128 characters of base64url encoding",
+        status: :bad_request
+      }
+    end
+
+    # Recreate code challenge based on method
+    expected_challenge = case auth_code.code_challenge_method
+                        when "plain"
+                          code_verifier
+                        when "S256"
+                          Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+                        else
+                          return {
+                            valid: false,
+                            error: "server_error",
+                            error_description: "Unsupported code challenge method",
+                            status: :internal_server_error
+                          }
+                        end
+
+    # Validate the code challenge
+    unless auth_code.code_challenge == expected_challenge
+      return {
+        valid: false,
+        error: "invalid_grant",
+        error_description: "Invalid code verifier",
+        status: :bad_request
+      }
+    end
+
+    { valid: true }
+  end
+
  def extract_client_credentials
    # Try Authorization header first (Basic auth)
    if request.headers["Authorization"]&.start_with?("Basic ")
@@ -353,4 +821,76 @@ class OidcController < ApplicationController
      [params[:client_id], params[:client_secret]]
    end
  end
+
+  def validate_logout_redirect_uri(uri)
+    return nil unless uri.present?
+
+    begin
+      parsed_uri = URI.parse(uri)
+
+      # Only allow HTTP/HTTPS schemes (prevent javascript:, data:, etc.)
+      return nil unless parsed_uri.is_a?(URI::HTTP) || parsed_uri.is_a?(URI::HTTPS)
+
+      # Only allow HTTPS in production
+      return nil if Rails.env.production? && parsed_uri.scheme != 'https'
+
+      # Check if URI matches any registered OIDC application's redirect URIs
+      # According to OIDC spec, post_logout_redirect_uri should be pre-registered
+      Application.oidc.active.find_each do |app|
+        # Check if this URI matches any of the app's registered redirect URIs
+        if app.parsed_redirect_uris.any? { |registered_uri| logout_uri_matches?(uri, registered_uri) }
+          return uri
+        end
+      end
+
+      # No matching application found
+      nil
+    rescue URI::InvalidURIError
+      nil
+    end
+  end
+
+  # Check if logout URI matches a registered redirect URI
+  # More lenient than exact match - allows same host/path with different query params
+  def logout_uri_matches?(provided, registered)
+    # Exact match is always valid
+    return true if provided == registered
+
+    # Parse both URIs to compare components
+    begin
+      provided_parsed = URI.parse(provided)
+      registered_parsed = URI.parse(registered)
+
+      # Match if scheme, host, port, and path are the same
+      # (allows different query params which is common for logout redirects)
+      provided_parsed.scheme == registered_parsed.scheme &&
+        provided_parsed.host == registered_parsed.host &&
+        provided_parsed.port == registered_parsed.port &&
+        provided_parsed.path == registered_parsed.path
+    rescue URI::InvalidURIError
+      false
+    end
+  end
+
+  def send_backchannel_logout_notifications(user)
+    # Find all active OIDC consents for this user
+    consents = OidcUserConsent.where(user: user).includes(:application)
+
+    consents.each do |consent|
+      # Skip if application doesn't support backchannel logout
+      next unless consent.application.supports_backchannel_logout?
+
+      # Enqueue background job to send logout notification
+      BackchannelLogoutJob.perform_later(
+        user_id: user.id,
+        application_id: consent.application.id,
+        consent_sid: consent.sid
+      )
+    end
+
+    Rails.logger.info "OidcController: Enqueued #{consents.count} backchannel logout notifications for user #{user.id}"
+  rescue => e
+    # Log error but don't block logout
+    Rails.logger.error "OidcController: Failed to enqueue backchannel logout: #{e.class} - #{e.message}"
+  end
 end
--- a/app/controllers/passwords_controller.rb
+++ b/app/controllers/passwords_controller.rb
@@ -11,7 +11,7 @@ class PasswordsController < ApplicationController
      PasswordsMailer.reset(user).deliver_later
    end

-    redirect_to new_session_path, notice: "Password reset instructions sent (if user with that email address exists)."
+    redirect_to signin_path, notice: "Password reset instructions sent (if user with that email address exists)."
  end

  def edit
@@ -20,7 +20,7 @@ class PasswordsController < ApplicationController
  def update
    if @user.update(params.permit(:password, :password_confirmation))
      @user.sessions.destroy_all
-      redirect_to new_session_path, notice: "Password has been reset."
+      redirect_to signin_path, notice: "Password has been reset."
    else
      redirect_to edit_password_path(params[:token]), alert: "Passwords did not match."
    end
@@ -29,6 +29,7 @@ class PasswordsController < ApplicationController
  private
    def set_user_by_token
      @user = User.find_by_token_for(:password_reset, params[:token])
+      redirect_to new_password_path, alert: "Password reset link is invalid or has expired." if @user.nil?
    rescue ActiveSupport::MessageVerifier::InvalidSignature
      redirect_to new_password_path, alert: "Password reset link is invalid or has expired."
    end
--- a/app/controllers/profiles_controller.rb
+++ b/app/controllers/profiles_controller.rb
@@ -19,13 +19,21 @@ class ProfilesController < ApplicationController
      else
        render :show, status: :unprocessable_entity
      end
-    else
-      # Updating email
+    elsif params[:user][:email_address].present?
+      # Updating email - requires current password (security: prevents account takeover)
+      unless @user.authenticate(params[:user][:current_password])
+        @user.errors.add(:current_password, "is required to change email")
+        render :show, status: :unprocessable_entity
+        return
+      end
+
      if @user.update(email_params)
        redirect_to profile_path, notice: "Email updated successfully."
      else
        render :show, status: :unprocessable_entity
      end
+    else
+      render :show, status: :unprocessable_entity
    end
  end

--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -6,7 +6,18 @@ class SessionsController < ApplicationController

  def new
    # Redirect to signup if this is first run
-    redirect_to signup_path if User.count.zero?
+    if User.count.zero?
+      respond_to do |format|
+        format.html { redirect_to signup_path }
+        format.json { render json: { error: "No users exist. Please complete initial setup." }, status: :service_unavailable }
+      end
+      return
+    end
+
+    respond_to do |format|
+      format.html # render HTML login page
+      format.json { render json: { error: "Authentication required" }, status: :unauthorized }
+    end
  end

  def create
@@ -33,8 +44,22 @@ class SessionsController < ApplicationController
      return
    end

-    # Check if TOTP is required
-    if user.totp_enabled?
+    # Check if TOTP is required or enabled
+    if user.totp_required? || user.totp_enabled?
+      # If TOTP is required but not yet set up, redirect to setup
+      if user.totp_required? && !user.totp_enabled?
+        # Store user ID in session for TOTP setup
+        session[:pending_totp_setup_user_id] = user.id
+        # Preserve the redirect URL through TOTP setup
+        if params[:rd].present?
+          validated_url = validate_redirect_url(params[:rd])
+          session[:totp_redirect_url] = validated_url if validated_url
+        end
+        redirect_to new_totp_path, alert: "Your administrator requires two-factor authentication. Please set it up now to continue."
+        return
+      end
+
+      # TOTP is enabled, proceed to verification
      # Store user ID in session temporarily for TOTP verification
      session[:pending_totp_user_id] = user.id
      # Preserve the redirect URL through TOTP verification (after validation)
@@ -109,6 +134,12 @@ class SessionsController < ApplicationController
  end

  def destroy
+    # Send backchannel logout notifications before terminating session
+    if authenticated?
+      user = Current.session.user
+      send_backchannel_logout_notifications(user)
+    end
+
    terminate_session
    redirect_to signin_path, status: :see_other, notice: "Signed out successfully."
  end
@@ -275,15 +306,37 @@ class SessionsController < ApplicationController
      redirect_domain = uri.host.downcase
      return nil unless redirect_domain.present?

-      # Check against our ForwardAuthRules
-      matching_rule = ForwardAuthRule.active.find do |rule|
-        rule.matches_domain?(redirect_domain)
+      # Check against our forward auth applications
+      matching_app = Application.forward_auth.active.find do |app|
+        app.matches_domain?(redirect_domain)
      end

-      matching_rule ? url : nil
+      matching_app ? url : nil

    rescue URI::InvalidURIError
      nil
    end
  end
+
+  def send_backchannel_logout_notifications(user)
+    # Find all active OIDC consents for this user
+    consents = OidcUserConsent.where(user: user).includes(:application)
+
+    consents.each do |consent|
+      # Skip if application doesn't support backchannel logout
+      next unless consent.application.supports_backchannel_logout?
+
+      # Enqueue background job to send logout notification
+      BackchannelLogoutJob.perform_later(
+        user_id: user.id,
+        application_id: consent.application.id,
+        consent_sid: consent.sid
+      )
+    end
+
+    Rails.logger.info "SessionsController: Enqueued #{consents.count} backchannel logout notifications for user #{user.id}"
+  rescue => e
+    # Log error but don't block logout
+    Rails.logger.error "SessionsController: Failed to enqueue backchannel logout: #{e.class} - #{e.message}"
+  end
 end
--- a/app/controllers/totp_controller.rb
+++ b/app/controllers/totp_controller.rb
@@ -5,6 +5,9 @@ class TotpController < ApplicationController

  # GET /totp/new - Show QR code to set up TOTP
  def new
+    # Check if user is being forced to set up TOTP by admin
+    @totp_setup_required = session[:pending_totp_setup_user_id].present?
+
    # Generate TOTP secret but don't save yet
    @totp_secret = ROTP::Base32.random
    @provisioning_uri = ROTP::TOTP.new(@totp_secret, issuer: "Clinch").provisioning_uri(@user.email_address)
@@ -30,8 +33,16 @@ class TotpController < ApplicationController
      # Store plain codes temporarily in session for display after redirect
      session[:temp_backup_codes] = plain_codes

-      # Redirect to backup codes page with success message
+      # Check if this was a required setup from login
+      if session[:pending_totp_setup_user_id].present?
+        session.delete(:pending_totp_setup_user_id)
+        # Mark that user should be auto-signed in after viewing backup codes
+        session[:auto_signin_after_forced_totp] = true
+        redirect_to backup_codes_totp_path, notice: "Two-factor authentication has been enabled successfully! Save these backup codes, then you'll be signed in."
+      else
+        # Regular setup from profile
        redirect_to backup_codes_totp_path, notice: "Two-factor authentication has been enabled successfully! Save these backup codes now."
+      end
    else
      redirect_to new_totp_path, alert: "Invalid verification code. Please try again."
    end
@@ -43,6 +54,12 @@ class TotpController < ApplicationController
    if session[:temp_backup_codes].present?
      @backup_codes = session[:temp_backup_codes]
      session.delete(:temp_backup_codes) # Clear after use
+
+      # Check if this was a forced TOTP setup during login
+      @auto_signin_pending = session[:auto_signin_after_forced_totp].present?
+      if @auto_signin_pending
+        session.delete(:auto_signin_after_forced_totp)
+      end
    else
      # This will be shown after password verification for existing users
      # Since we can't display BCrypt hashes, redirect to regenerate
@@ -81,6 +98,18 @@ class TotpController < ApplicationController
    redirect_to backup_codes_totp_path, notice: "New backup codes have been generated. Save them now!"
  end

+  # POST /totp/complete_setup - Complete forced TOTP setup and sign in
+  def complete_setup
+    # Sign in the user after they've saved their backup codes
+    # This is only used when admin requires TOTP and user just set it up during login
+    if session[:totp_redirect_url].present?
+      session[:return_to_after_authenticating] = session.delete(:totp_redirect_url)
+    end
+
+    start_new_session_for @user
+    redirect_to after_authentication_url, notice: "Two-factor authentication enabled. Signed in successfully.", allow_other_host: true
+  end
+
  # DELETE /totp - Disable TOTP (requires password)
  def destroy
    unless @user.authenticate(params[:password])
@@ -88,6 +117,12 @@ class TotpController < ApplicationController
      return
    end

+    # Prevent disabling if admin requires TOTP
+    if @user.totp_required?
+      redirect_to profile_path, alert: "Two-factor authentication is required by your administrator and cannot be disabled."
+      return
+    end
+
    @user.disable_totp!
    redirect_to profile_path, notice: "Two-factor authentication has been disabled."
  end
@@ -99,7 +134,8 @@ class TotpController < ApplicationController
  end

  def redirect_if_totp_enabled
-    if @user.totp_enabled?
+    # Allow setup if admin requires it, even if already enabled (for regeneration)
+    if @user.totp_enabled? && !session[:pending_totp_setup_user_id].present?
      redirect_to profile_path, alert: "Two-factor authentication is already enabled."
    end
  end
--- a/app/controllers/webauthn_controller.rb
+++ b/app/controllers/webauthn_controller.rb
@@ -2,6 +2,11 @@ class WebauthnController < ApplicationController
  before_action :set_webauthn_credential, only: [:destroy]
  skip_before_action :require_authentication, only: [:check]

+  # Rate limit check endpoint to prevent enumeration attacks
+  rate_limit to: 10, within: 1.minute, only: [:check], with: -> {
+    render json: { error: "Too many requests. Try again later." }, status: :too_many_requests
+  }
+
  # GET /webauthn/new
  def new
    @webauthn_credential = WebauthnCredential.new
@@ -104,14 +109,6 @@ class WebauthnController < ApplicationController
  # DELETE /webauthn/:id
  # Remove a passkey
  def destroy
-    user = Current.session&.user
-    return render json: { error: "Not authenticated" }, status: :unauthorized unless user
-
-    if @webauthn_credential.user != user
-      render json: { error: "Unauthorized" }, status: :forbidden
-      return
-    end
-
    nickname = @webauthn_credential.nickname
    @webauthn_credential.destroy

@@ -131,25 +128,27 @@ class WebauthnController < ApplicationController

  # GET /webauthn/check
  # Check if user has WebAuthn credentials (for login page detection)
+  # Security: Returns identical responses for non-existent users to prevent enumeration
  def check
    email = params[:email]&.strip&.downcase

    if email.blank?
-      render json: { has_webauthn: false, error: "Email is required" }
+      render json: { has_webauthn: false, requires_webauthn: false }
      return
    end

    user = User.find_by(email_address: email)

+    # Security: Return identical response for non-existent users
+    # Combined with rate limiting (10/min), this prevents account enumeration
    if user.nil?
-      render json: { has_webauthn: false, message: "User not found" }
+      render json: { has_webauthn: false, requires_webauthn: false }
      return
    end

+    # Only return minimal necessary info - no user_id or preferred_method
    render json: {
      has_webauthn: user.can_authenticate_with_webauthn?,
-      user_id: user.id,
-      preferred_method: user.preferred_authentication_method,
      requires_webauthn: user.require_webauthn?
    }
  end
@@ -173,16 +172,13 @@ class WebauthnController < ApplicationController
  end

  def set_webauthn_credential
-    @webauthn_credential = WebauthnCredential.find(params[:id])
+    user = Current.session&.user
+    return render json: { error: "Not authenticated" }, status: :unauthorized unless user
+    @webauthn_credential = user.webauthn_credentials.find(params[:id])
  rescue ActiveRecord::RecordNotFound
    respond_to do |format|
-      format.html {
-        redirect_to profile_path,
-        alert: "Passkey not found"
-      }
-      format.json {
-        render json: { error: "Passkey not found" }, status: :not_found
-      }
+      format.html { redirect_to profile_path, alert: "Passkey not found" }
+      format.json { render json: { error: "Passkey not found" }, status: :not_found }
    end
  end

--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -19,4 +19,14 @@ module ApplicationHelper
      :smtp
    end
  end
+
+  def border_class_for(type)
+    case type.to_s
+    when 'notice' then 'border-green-200'
+    when 'alert', 'error' then 'border-red-200'
+    when 'warning' then 'border-yellow-200'
+    when 'info' then 'border-blue-200'
+    else 'border-gray-200'
+    end
+  end
 end
--- a/app/helpers/claims_helper.rb
+++ b/app/helpers/claims_helper.rb
@@ -0,0 +1,69 @@
+module ClaimsHelper
+  include ClaimsMerger
+
+  # Preview final merged claims for a user accessing an application
+  def preview_user_claims(user, application)
+    claims = {
+      # Standard OIDC claims
+      email: user.email_address,
+      email_verified: true,
+      preferred_username: user.username.presence || user.email_address,
+      name: user.name.presence || user.email_address
+    }
+
+    # Add groups
+    if user.groups.any?
+      claims[:groups] = user.groups.pluck(:name)
+    end
+
+    # Merge group custom claims (arrays are combined, not overwritten)
+    user.groups.each do |group|
+      claims = deep_merge_claims(claims, group.parsed_custom_claims)
+    end
+
+    # Merge user custom claims (arrays are combined, other values override)
+    claims = deep_merge_claims(claims, user.parsed_custom_claims)
+
+    # Merge app-specific claims (arrays are combined)
+    claims = deep_merge_claims(claims, application.custom_claims_for_user(user))
+
+    claims
+  end
+
+  # Get claim sources breakdown for display
+  def claim_sources(user, application)
+    sources = []
+
+    # Group claims
+    user.groups.each do |group|
+      if group.parsed_custom_claims.any?
+        sources << {
+          type: :group,
+          name: group.name,
+          claims: group.parsed_custom_claims
+        }
+      end
+    end
+
+    # User claims
+    if user.parsed_custom_claims.any?
+      sources << {
+        type: :user,
+        name: "User Override",
+        claims: user.parsed_custom_claims
+      }
+    end
+
+    # App-specific claims
+    app_claims = application.custom_claims_for_user(user)
+    if app_claims.any?
+      sources << {
+        type: :application,
+        name: "App-Specific (#{application.name})",
+        claims: app_claims
+      }
+    end
+
+    sources
+  end
+end
--- a/app/javascript/controllers/application_form_controller.js
+++ b/app/javascript/controllers/application_form_controller.js
@@ -1,7 +1,7 @@
 import { Controller } from "@hotwired/stimulus"

 export default class extends Controller {
-  static targets = ["appTypeSelect", "oidcFields", "forwardAuthFields"]
+  static targets = ["appTypeSelect", "oidcFields", "forwardAuthFields", "pkceOptions"]

  connect() {
    this.updateFieldVisibility()
@@ -21,4 +21,17 @@ export default class extends Controller {
      this.forwardAuthFieldsTarget.classList.add('hidden')
    }
  }
+
+  updatePkceVisibility(event) {
+    // Show PKCE options for confidential clients, hide for public clients
+    const isPublicClient = event.target.value === "true"
+
+    if (this.hasPkceOptionsTarget) {
+      if (isPublicClient) {
+        this.pkceOptionsTarget.classList.add('hidden')
+      } else {
+        this.pkceOptionsTarget.classList.remove('hidden')
+      }
+    }
+  }
 }
--- a/app/javascript/controllers/file_drop_controller.js
+++ b/app/javascript/controllers/file_drop_controller.js
@@ -0,0 +1,96 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static targets = ["input", "dropzone", "preview", "previewImage", "filename", "filesize"]
+
+  connect() {
+    // Prevent default drag behaviors on the whole document
+    ["dragenter", "dragover", "dragleave", "drop"].forEach(eventName => {
+      document.body.addEventListener(eventName, this.preventDefaults, false)
+    })
+  }
+
+  disconnect() {
+    ["dragenter", "dragover", "dragleave", "drop"].forEach(eventName => {
+      document.body.removeEventListener(eventName, this.preventDefaults, false)
+    })
+  }
+
+  preventDefaults(e) {
+    e.preventDefault()
+    e.stopPropagation()
+  }
+
+  dragover(e) {
+    e.preventDefault()
+    e.stopPropagation()
+    this.dropzoneTarget.classList.add("border-blue-500", "bg-blue-50")
+  }
+
+  dragleave(e) {
+    e.preventDefault()
+    e.stopPropagation()
+    this.dropzoneTarget.classList.remove("border-blue-500", "bg-blue-50")
+  }
+
+  drop(e) {
+    e.preventDefault()
+    e.stopPropagation()
+    this.dropzoneTarget.classList.remove("border-blue-500", "bg-blue-50")
+
+    const files = e.dataTransfer.files
+    if (files.length > 0) {
+      // Set the file to the input element
+      this.inputTarget.files = files
+      this.handleFiles()
+    }
+  }
+
+  handleFiles() {
+    const file = this.inputTarget.files[0]
+    if (!file) return
+
+    // Validate file type
+    const validTypes = ["image/png", "image/jpg", "image/jpeg", "image/gif", "image/svg+xml"]
+    if (!validTypes.includes(file.type)) {
+      alert("Please upload a PNG, JPG, GIF, or SVG image")
+      this.clear()
+      return
+    }
+
+    // Validate file size (2MB)
+    if (file.size > 2 * 1024 * 1024) {
+      alert("File size must be less than 2MB")
+      this.clear()
+      return
+    }
+
+    // Show preview
+    this.filenameTarget.textContent = file.name
+    this.filesizeTarget.textContent = this.formatFileSize(file.size)
+
+    // Create preview image
+    const reader = new FileReader()
+    reader.onload = (e) => {
+      this.previewImageTarget.src = e.target.result
+      this.previewTarget.classList.remove("hidden")
+    }
+    reader.readAsDataURL(file)
+  }
+
+  clear(e) {
+    if (e) {
+      e.preventDefault()
+    }
+    this.inputTarget.value = ""
+    this.previewTarget.classList.add("hidden")
+  }
+
+  formatFileSize(bytes) {
+    if (bytes === 0) return "0 Bytes"
+    const k = 1024
+    const sizes = ["Bytes", "KB", "MB"]
+    const i = Math.floor(Math.log(bytes) / Math.log(k))
+    return Math.round(bytes / Math.pow(k, i) * 100) / 100 + " " + sizes[i]
+  }
+}
--- a/app/javascript/controllers/image_paste_controller.js
+++ b/app/javascript/controllers/image_paste_controller.js
@@ -0,0 +1,121 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static targets = ["input", "dropzone"]
+
+  connect() {
+    // Listen for paste events on the dropzone
+    this.dropzoneTarget.addEventListener("paste", this.handlePaste.bind(this))
+  }
+
+  disconnect() {
+    this.dropzoneTarget.removeEventListener("paste", this.handlePaste.bind(this))
+  }
+
+  handlePaste(e) {
+    e.preventDefault()
+    e.stopPropagation()
+
+    const clipboardData = e.clipboardData || e.originalEvent.clipboardData
+
+    // First, try to get image data
+    for (let item of clipboardData.items) {
+      if (item.type.indexOf("image") !== -1) {
+        const blob = item.getAsFile()
+        this.handleImageBlob(blob)
+        return
+      }
+    }
+
+    // If no image found, check for SVG text
+    const text = clipboardData.getData("text/plain")
+    if (text && this.isSVG(text)) {
+      this.handleSVGText(text)
+      return
+    }
+  }
+
+  isSVG(text) {
+    // Check if the text looks like SVG code
+    const trimmed = text.trim()
+    return trimmed.startsWith("<svg") && trimmed.includes("</svg>")
+  }
+
+  handleSVGText(svgText) {
+    // Validate file size (2MB)
+    const size = new Blob([svgText]).size
+    if (size > 2 * 1024 * 1024) {
+      alert("SVG code is too large (must be less than 2MB)")
+      return
+    }
+
+    // Create a blob from the SVG text
+    const blob = new Blob([svgText], { type: "image/svg+xml" })
+
+    // Create a File object
+    const file = new File([blob], `pasted-svg-${Date.now()}.svg`, {
+      type: "image/svg+xml"
+    })
+
+    // Create a DataTransfer object to set files on the input
+    const dataTransfer = new DataTransfer()
+    dataTransfer.items.add(file)
+    this.inputTarget.files = dataTransfer.files
+
+    // Trigger change event to update preview (file-drop controller will handle it)
+    const event = new Event("change", { bubbles: true })
+    this.inputTarget.dispatchEvent(event)
+
+    // Visual feedback
+    this.dropzoneTarget.classList.add("border-green-500", "bg-green-50")
+    setTimeout(() => {
+      this.dropzoneTarget.classList.remove("border-green-500", "bg-green-50")
+    }, 500)
+  }
+
+  handleImageBlob(blob) {
+    // Validate file type
+    const validTypes = ["image/png", "image/jpg", "image/jpeg", "image/gif", "image/svg+xml"]
+    if (!validTypes.includes(blob.type)) {
+      alert("Please paste a PNG, JPG, GIF, or SVG image")
+      return
+    }
+
+    // Validate file size (2MB)
+    if (blob.size > 2 * 1024 * 1024) {
+      alert("Image size must be less than 2MB")
+      return
+    }
+
+    // Create a File object from the blob with a default name
+    const file = new File([blob], `pasted-image-${Date.now()}.${this.getExtension(blob.type)}`, {
+      type: blob.type
+    })
+
+    // Create a DataTransfer object to set files on the input
+    const dataTransfer = new DataTransfer()
+    dataTransfer.items.add(file)
+    this.inputTarget.files = dataTransfer.files
+
+    // Trigger change event to update preview (file-drop controller will handle it)
+    const event = new Event("change", { bubbles: true })
+    this.inputTarget.dispatchEvent(event)
+
+    // Visual feedback
+    this.dropzoneTarget.classList.add("border-green-500", "bg-green-50")
+    setTimeout(() => {
+      this.dropzoneTarget.classList.remove("border-green-500", "bg-green-50")
+    }, 500)
+  }
+
+  getExtension(mimeType) {
+    const extensions = {
+      "image/png": "png",
+      "image/jpeg": "jpg",
+      "image/jpg": "jpg",
+      "image/gif": "gif",
+      "image/svg+xml": "svg"
+    }
+    return extensions[mimeType] || "png"
+  }
+}
--- a/app/jobs/backchannel_logout_job.rb
+++ b/app/jobs/backchannel_logout_job.rb
@@ -0,0 +1,52 @@
+class BackchannelLogoutJob < ApplicationJob
+  queue_as :default
+
+  # Retry with exponential backoff: 1s, 5s, 25s
+  retry_on StandardError, wait: :exponentially_longer, attempts: 3
+
+  def perform(user_id:, application_id:, consent_sid:)
+    # Find the records
+    user = User.find_by(id: user_id)
+    application = Application.find_by(id: application_id)
+    consent = OidcUserConsent.find_by(sid: consent_sid)
+
+    # Validate we have all required data
+    unless user && application && consent
+      Rails.logger.warn "BackchannelLogout: Missing data - user: #{user.present?}, app: #{application.present?}, consent: #{consent.present?}"
+      return
+    end
+
+    # Skip if application doesn't support backchannel logout
+    unless application.supports_backchannel_logout?
+      Rails.logger.debug "BackchannelLogout: Application #{application.name} doesn't support backchannel logout"
+      return
+    end
+
+    # Generate the logout token
+    logout_token = OidcJwtService.generate_logout_token(user, application, consent)
+
+    # Send HTTP POST to the application's backchannel logout URI
+    uri = URI.parse(application.backchannel_logout_uri)
+
+    begin
+      response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https', open_timeout: 5, read_timeout: 5) do |http|
+        request = Net::HTTP::Post.new(uri.path.presence || '/')
+        request['Content-Type'] = 'application/x-www-form-urlencoded'
+        request.set_form_data({ logout_token: logout_token })
+        http.request(request)
+      end
+
+      if response.code.to_i == 200
+        Rails.logger.info "BackchannelLogout: Successfully sent logout notification to #{application.name} (#{application.backchannel_logout_uri})"
+      else
+        Rails.logger.warn "BackchannelLogout: Application #{application.name} returned HTTP #{response.code} from #{application.backchannel_logout_uri}"
+      end
+    rescue Net::OpenTimeout, Net::ReadTimeout => e
+      Rails.logger.warn "BackchannelLogout: Timeout sending logout to #{application.name} (#{application.backchannel_logout_uri}): #{e.message}"
+      raise # Retry on timeout
+    rescue StandardError => e
+      Rails.logger.error "BackchannelLogout: Failed to send logout to #{application.name} (#{application.backchannel_logout_uri}): #{e.class} - #{e.message}"
+      raise # Retry on error
+    end
+  end
+end
--- a/app/jobs/oidc_token_cleanup_job.rb
+++ b/app/jobs/oidc_token_cleanup_job.rb
@@ -0,0 +1,29 @@
+class OidcTokenCleanupJob < ApplicationJob
+  queue_as :default
+
+  def perform
+    # Delete expired access tokens (keep revoked ones for audit trail)
+    expired_access_tokens = OidcAccessToken.where("expires_at < ?", 7.days.ago)
+    deleted_count = expired_access_tokens.delete_all
+    Rails.logger.info "OIDC Token Cleanup: Deleted #{deleted_count} expired access tokens"
+
+    # Delete expired refresh tokens (keep revoked ones for audit trail)
+    expired_refresh_tokens = OidcRefreshToken.where("expires_at < ?", 7.days.ago)
+    deleted_count = expired_refresh_tokens.delete_all
+    Rails.logger.info "OIDC Token Cleanup: Deleted #{deleted_count} expired refresh tokens"
+
+    # Delete old revoked tokens (after 30 days for audit trail)
+    old_revoked_access_tokens = OidcAccessToken.where("revoked_at < ?", 30.days.ago)
+    deleted_count = old_revoked_access_tokens.delete_all
+    Rails.logger.info "OIDC Token Cleanup: Deleted #{deleted_count} old revoked access tokens"
+
+    old_revoked_refresh_tokens = OidcRefreshToken.where("revoked_at < ?", 30.days.ago)
+    deleted_count = old_revoked_refresh_tokens.delete_all
+    Rails.logger.info "OIDC Token Cleanup: Deleted #{deleted_count} old revoked refresh tokens"
+
+    # Delete old used authorization codes (after 7 days)
+    old_auth_codes = OidcAuthorizationCode.where("created_at < ?", 7.days.ago)
+    deleted_count = old_auth_codes.delete_all
+    Rails.logger.info "OIDC Token Cleanup: Deleted #{deleted_count} old authorization codes"
+  end
+end
--- a/app/mailers/application_mailer.rb
+++ b/app/mailers/application_mailer.rb
@@ -1,4 +1,4 @@
 class ApplicationMailer < ActionMailer::Base
-  default from: ENV.fetch('CLINCH_EMAIL_FROM', 'clinch@example.com')
+  default from: ENV.fetch('CLINCH_FROM_EMAIL', 'clinch@example.com')
  layout "mailer"
 end
--- a/app/models/application.rb
+++ b/app/models/application.rb
@@ -1,10 +1,21 @@
 class Application < ApplicationRecord
  has_secure_password :client_secret, validations: false

+  # Virtual attribute to control client type during creation
+  # When true, no client_secret will be generated (public client)
+  attr_accessor :is_public_client
+
+  has_one_attached :icon
+
+  # Fix SVG content type after attachment
+  after_save :fix_icon_content_type, if: -> { icon.attached? && saved_change_to_attribute?(:id) == false }
+
  has_many :application_groups, dependent: :destroy
  has_many :allowed_groups, through: :application_groups, source: :group
+  has_many :application_user_claims, dependent: :destroy
  has_many :oidc_authorization_codes, dependent: :destroy
  has_many :oidc_access_tokens, dependent: :destroy
+  has_many :oidc_refresh_tokens, dependent: :destroy
  has_many :oidc_user_consents, dependent: :destroy

  validates :name, presence: true
@@ -13,12 +24,33 @@ class Application < ApplicationRecord
  validates :app_type, presence: true,
                      inclusion: { in: %w[oidc forward_auth] }
  validates :client_id, uniqueness: { allow_nil: true }
-  validates :client_secret, presence: true, on: :create, if: -> { oidc? }
+  validates :client_secret, presence: true, on: :create, if: -> { oidc? && confidential_client? }
  validates :domain_pattern, presence: true, uniqueness: { case_sensitive: false }, if: :forward_auth?
  validates :landing_url, format: { with: URI::regexp(%w[http https]), allow_nil: true, message: "must be a valid URL" }
+  validates :backchannel_logout_uri, format: {
+    with: URI::regexp(%w[http https]),
+    allow_nil: true,
+    message: "must be a valid HTTP or HTTPS URL"
+  }
+  validate :backchannel_logout_uri_must_be_https_in_production, if: -> { backchannel_logout_uri.present? }
+
+  # Icon validation using ActiveStorage validators
+  validate :icon_validation, if: -> { icon.attached? }
+
+  # Token TTL validations (for OIDC apps)
+  validates :access_token_ttl, numericality: { greater_than_or_equal_to: 300, less_than_or_equal_to: 86400 }, if: :oidc?  # 5 min - 24 hours
+  validates :refresh_token_ttl, numericality: { greater_than_or_equal_to: 86400, less_than_or_equal_to: 7776000 }, if: :oidc?  # 1 day - 90 days
+  validates :id_token_ttl, numericality: { greater_than_or_equal_to: 300, less_than_or_equal_to: 86400 }, if: :oidc?  # 5 min - 24 hours

  normalizes :slug, with: ->(slug) { slug.strip.downcase }
-  normalizes :domain_pattern, with: ->(pattern) { pattern&.strip&.downcase }
+  normalizes :domain_pattern, with: ->(pattern) {
+    normalized = pattern&.strip&.downcase
+    normalized.blank? ? nil : normalized
+  }
+  normalizes :backchannel_logout_uri, with: ->(uri) {
+    normalized = uri&.strip
+    normalized.blank? ? nil : normalized
+  }

  before_validation :generate_client_credentials, on: :create, if: :oidc?

@@ -46,6 +78,24 @@ class Application < ApplicationRecord
    app_type == "forward_auth"
  end

+  # Client type checks (for OIDC)
+  def public_client?
+    client_secret_digest.blank?
+  end
+
+  def confidential_client?
+    !public_client?
+  end
+
+  # PKCE requirement check
+  # Public clients MUST use PKCE (no client secret to protect auth code)
+  # Confidential clients can optionally require PKCE (OAuth 2.1 recommendation)
+  def requires_pkce?
+    return false unless oidc?
+    return true if public_client?  # Always require PKCE for public clients
+    require_pkce?  # Check the flag for confidential clients
+  end
+
  # Access control
  def user_allowed?(user)
    return false unless active?
@@ -151,14 +201,112 @@ class Application < ApplicationRecord
    secret
  end

+  # Token TTL helper methods (for OIDC)
+  def access_token_expiry
+    (access_token_ttl || 3600).seconds.from_now
+  end
+
+  def refresh_token_expiry
+    (refresh_token_ttl || 2592000).seconds.from_now
+  end
+
+  def id_token_expiry_seconds
+    id_token_ttl || 3600
+  end
+
+  # Human-readable TTL for display
+  def access_token_ttl_human
+    duration_to_human(access_token_ttl || 3600)
+  end
+
+  def refresh_token_ttl_human
+    duration_to_human(refresh_token_ttl || 2592000)
+  end
+
+  def id_token_ttl_human
+    duration_to_human(id_token_ttl || 3600)
+  end
+
+  # Get app-specific custom claims for a user
+  def custom_claims_for_user(user)
+    app_claim = application_user_claims.find_by(user: user)
+    app_claim&.parsed_custom_claims || {}
+  end
+
+  # Check if this application supports backchannel logout
+  def supports_backchannel_logout?
+    backchannel_logout_uri.present?
+  end
+
+  # Check if a user has an active session with this application
+  # (i.e., has valid, non-revoked tokens)
+  def user_has_active_session?(user)
+    oidc_access_tokens.where(user: user).valid.exists? ||
+    oidc_refresh_tokens.where(user: user).valid.exists?
+  end
+
  private

+  def fix_icon_content_type
+    return unless icon.attached?
+
+    # Fix SVG content type if it was detected incorrectly
+    if icon.filename.extension == "svg" && icon.content_type == "application/octet-stream"
+      icon.blob.update(content_type: "image/svg+xml")
+    end
+  end
+
+  def icon_validation
+    return unless icon.attached?
+
+    # Check content type
+    allowed_types = ['image/png', 'image/jpg', 'image/jpeg', 'image/gif', 'image/svg+xml']
+    unless allowed_types.include?(icon.content_type)
+      errors.add(:icon, 'must be a PNG, JPG, GIF, or SVG image')
+    end
+
+    # Check file size (2MB limit)
+    if icon.blob.byte_size > 2.megabytes
+      errors.add(:icon, 'must be less than 2MB')
+    end
+  end
+
+  def duration_to_human(seconds)
+    if seconds < 3600
+      "#{seconds / 60} minutes"
+    elsif seconds < 86400
+      "#{seconds / 3600} hours"
+    else
+      "#{seconds / 86400} days"
+    end
+  end
+
  def generate_client_credentials
    self.client_id ||= SecureRandom.urlsafe_base64(32)
-    # Generate and hash the client secret
-    if new_record? && client_secret.blank?
+    # Generate client secret only for confidential clients
+    # Public clients (is_public_client checked) don't get a secret - they use PKCE only
+    if new_record? && client_secret.blank? && !is_public_client_selected?
      secret = SecureRandom.urlsafe_base64(48)
      self.client_secret = secret
    end
  end
+
+  # Check if the user selected public client option
+  def is_public_client_selected?
+    ActiveModel::Type::Boolean.new.cast(is_public_client)
+  end
+
+  def backchannel_logout_uri_must_be_https_in_production
+    return unless Rails.env.production?
+    return unless backchannel_logout_uri.present?
+
+    begin
+      uri = URI.parse(backchannel_logout_uri)
+      unless uri.scheme == 'https'
+        errors.add(:backchannel_logout_uri, 'must use HTTPS in production')
+      end
+    rescue URI::InvalidURIError
+      # Let the format validator handle invalid URIs
+    end
+  end
 end
--- a/app/models/application_user_claim.rb
+++ b/app/models/application_user_claim.rb
@@ -0,0 +1,31 @@
+class ApplicationUserClaim < ApplicationRecord
+  belongs_to :application
+  belongs_to :user
+
+  # Reserved OIDC claim names that should not be overridden
+  RESERVED_CLAIMS = %w[
+    iss sub aud exp iat nbf jti nonce azp
+    email email_verified preferred_username name
+    groups
+  ].freeze
+
+  validates :user_id, uniqueness: { scope: :application_id }
+  validate :no_reserved_claim_names
+
+  # Parse custom_claims JSON field
+  def parsed_custom_claims
+    return {} if custom_claims.blank?
+    custom_claims.is_a?(Hash) ? custom_claims : {}
+  end
+
+  private
+
+  def no_reserved_claim_names
+    return if custom_claims.blank?
+
+    reserved_used = parsed_custom_claims.keys.map(&:to_s) & RESERVED_CLAIMS
+    if reserved_used.any?
+      errors.add(:custom_claims, "cannot override reserved OIDC claims: #{reserved_used.join(', ')}")
+    end
+  end
+end
--- a/app/models/concerns/token_prefixable.rb
+++ b/app/models/concerns/token_prefixable.rb
@@ -0,0 +1,53 @@
+module TokenPrefixable
+  extend ActiveSupport::Concern
+
+  class_methods do
+    # Compute HMAC prefix from plaintext token
+    # Returns first 8 chars of Base64url-encoded HMAC
+    # Does NOT reveal anything about the token
+    def compute_token_prefix(plaintext_token)
+      return nil if plaintext_token.blank?
+
+      hmac = OpenSSL::HMAC.digest('SHA256', TokenHmac::KEY, plaintext_token)
+      Base64.urlsafe_encode64(hmac)[0..7]
+    end
+
+    # Find token using HMAC prefix lookup (fast, indexed)
+    def find_by_token(plaintext_token)
+      return nil if plaintext_token.blank?
+
+      prefix = compute_token_prefix(plaintext_token)
+
+      # Fast indexed lookup by HMAC prefix
+      where(token_prefix: prefix).find_each do |token|
+        return token if token.token_matches?(plaintext_token)
+      end
+
+      nil
+    end
+  end
+
+  # Check if a plaintext token matches the hashed token
+  def token_matches?(plaintext_token)
+    return false if plaintext_token.blank? || token_digest.blank?
+
+    BCrypt::Password.new(token_digest) == plaintext_token
+  rescue BCrypt::Errors::InvalidHash
+    false
+  end
+
+  # Generate new token with HMAC prefix
+  # Sets both virtual attribute (for returning to client) and digest (for storage)
+  def generate_token_with_prefix
+    plaintext = SecureRandom.urlsafe_base64(48)
+    self.token_prefix = self.class.compute_token_prefix(plaintext)
+    self.token_digest = BCrypt::Password.create(plaintext)
+
+    # Set the virtual attribute - different models use different names
+    if respond_to?(:plaintext_token=)
+      self.plaintext_token = plaintext  # OidcAccessToken
+    elsif respond_to?(:token=)
+      self.token = plaintext  # OidcRefreshToken
+    end
+  end
+end
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -4,11 +4,31 @@ class Group < ApplicationRecord
  has_many :application_groups, dependent: :destroy
  has_many :applications, through: :application_groups

+  # Reserved OIDC claim names that should not be overridden
+  RESERVED_CLAIMS = %w[
+    iss sub aud exp iat nbf jti nonce azp
+    email email_verified preferred_username name
+    groups
+  ].freeze
+
  validates :name, presence: true, uniqueness: { case_sensitive: false }
  normalizes :name, with: ->(name) { name.strip.downcase }
+  validate :no_reserved_claim_names

  # Parse custom_claims JSON field
  def parsed_custom_claims
-    custom_claims || {}
+    return {} if custom_claims.blank?
+    custom_claims.is_a?(Hash) ? custom_claims : {}
+  end
+
+  private
+
+  def no_reserved_claim_names
+    return if custom_claims.blank?
+
+    reserved_used = parsed_custom_claims.keys.map(&:to_s) & RESERVED_CLAIMS
+    if reserved_used.any?
+      errors.add(:custom_claims, "cannot override reserved OIDC claims: #{reserved_used.join(', ')}")
+    end
  end
 end
--- a/app/models/oidc_access_token.rb
+++ b/app/models/oidc_access_token.rb
@@ -1,34 +1,47 @@
 class OidcAccessToken < ApplicationRecord
+  include TokenPrefixable
+
  belongs_to :application
  belongs_to :user
+  has_many :oidc_refresh_tokens, dependent: :destroy

-  before_validation :generate_token, on: :create
+  before_validation :generate_token_with_prefix, on: :create
  before_validation :set_expiry, on: :create

-  validates :token, presence: true, uniqueness: true
+  validates :token_digest, presence: true
+  validates :token_prefix, presence: true

-  scope :valid, -> { where("expires_at > ?", Time.current) }
+  scope :valid, -> { where("expires_at > ?", Time.current).where(revoked_at: nil) }
  scope :expired, -> { where("expires_at <= ?", Time.current) }
+  scope :revoked, -> { where.not(revoked_at: nil) }
+  scope :active, -> { valid }
+
+  attr_accessor :plaintext_token  # Store plaintext temporarily for returning to client

  def expired?
    expires_at <= Time.current
  end

+  def revoked?
+    revoked_at.present?
+  end
+
  def active?
-    !expired?
+    !expired? && !revoked?
  end

  def revoke!
-    update!(expires_at: Time.current)
+    update!(revoked_at: Time.current)
+    # Also revoke associated refresh tokens
+    oidc_refresh_tokens.each(&:revoke!)
  end

+  # find_by_token, token_matches?, and generate_token_with_prefix
+  # are now provided by TokenPrefixable concern
+
  private

-  def generate_token
-    self.token ||= SecureRandom.urlsafe_base64(48)
-  end
-
  def set_expiry
-    self.expires_at ||= 1.hour.from_now
+    self.expires_at ||= application.access_token_expiry
  end
 end
--- a/app/models/oidc_authorization_code.rb
+++ b/app/models/oidc_authorization_code.rb
@@ -7,6 +7,8 @@ class OidcAuthorizationCode < ApplicationRecord

  validates :code, presence: true, uniqueness: true
  validates :redirect_uri, presence: true
+  validates :code_challenge_method, inclusion: { in: %w[plain S256], allow_nil: true }
+  validate :validate_code_challenge_format, if: -> { code_challenge.present? }

  scope :valid, -> { where(used: false).where("expires_at > ?", Time.current) }
  scope :expired, -> { where("expires_at <= ?", Time.current) }
@@ -23,6 +25,10 @@ class OidcAuthorizationCode < ApplicationRecord
    update!(used: true)
  end

+  def uses_pkce?
+    code_challenge.present?
+  end
+
  private

  def generate_code
@@ -32,4 +38,11 @@ class OidcAuthorizationCode < ApplicationRecord
  def set_expiry
    self.expires_at ||= 10.minutes.from_now
  end
+
+  def validate_code_challenge_format
+    # PKCE code challenge should be base64url-encoded, 43-128 characters
+    unless code_challenge.match?(/\A[A-Za-z0-9\-_]{43,128}\z/)
+      errors.add(:code_challenge, "must be 43-128 characters of base64url encoding")
+    end
+  end
 end
--- a/app/models/oidc_refresh_token.rb
+++ b/app/models/oidc_refresh_token.rb
@@ -0,0 +1,63 @@
+class OidcRefreshToken < ApplicationRecord
+  include TokenPrefixable
+
+  belongs_to :application
+  belongs_to :user
+  belongs_to :oidc_access_token
+
+  before_validation :generate_token_with_prefix, on: :create
+  before_validation :set_expiry, on: :create
+  before_validation :set_token_family_id, on: :create
+
+  validates :token_digest, presence: true, uniqueness: true
+  validates :token_prefix, presence: true
+
+  scope :valid, -> { where("expires_at > ?", Time.current).where(revoked_at: nil) }
+  scope :expired, -> { where("expires_at <= ?", Time.current) }
+  scope :revoked, -> { where.not(revoked_at: nil) }
+  scope :active, -> { valid }
+
+  # For token rotation detection (prevents reuse attacks)
+  scope :in_family, ->(family_id) { where(token_family_id: family_id) }
+
+  attr_accessor :token  # Store plaintext token temporarily for returning to client
+
+  def expired?
+    expires_at <= Time.current
+  end
+
+  def revoked?
+    revoked_at.present?
+  end
+
+  def active?
+    !expired? && !revoked?
+  end
+
+  def revoke!
+    update!(revoked_at: Time.current)
+  end
+
+  # Revoke all refresh tokens in the same family (token rotation security)
+  def revoke_family!
+    return unless token_family_id.present?
+
+    OidcRefreshToken.in_family(token_family_id).update_all(revoked_at: Time.current)
+  end
+
+  # find_by_token, token_matches?, and generate_token_with_prefix
+  # are now provided by TokenPrefixable concern
+
+  private
+
+  def set_expiry
+    # Use application's configured refresh token TTL
+    self.expires_at ||= application.refresh_token_expiry
+  end
+
+  def set_token_family_id
+    # Use a random ID to group tokens in the same rotation chain
+    # This helps detect token reuse attacks
+    self.token_family_id ||= SecureRandom.random_number(2**31)
+  end
+end
--- a/app/models/oidc_user_consent.rb
+++ b/app/models/oidc_user_consent.rb
@@ -6,6 +6,7 @@ class OidcUserConsent < ApplicationRecord
  validates :user_id, uniqueness: { scope: :application_id }

  before_validation :set_granted_at, on: :create
+  before_validation :set_sid, on: :create

  # Parse scopes_granted into an array
  def scopes
@@ -44,9 +45,18 @@ class OidcUserConsent < ApplicationRecord
    end.join(', ')
  end

+  # Find consent by SID
+  def self.find_by_sid(sid)
+    find_by(sid: sid)
+  end
+
  private

  def set_granted_at
    self.granted_at ||= Time.current
  end
+
+  def set_sid
+    self.sid ||= SecureRandom.uuid
+  end
 end
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,8 +1,12 @@
 class User < ApplicationRecord
+  # Encrypt TOTP secrets at rest (key derived from SECRET_KEY_BASE)
+  encrypts :totp_secret
+
  has_secure_password
  has_many :sessions, dependent: :destroy
  has_many :user_groups, dependent: :destroy
  has_many :groups, through: :user_groups
+  has_many :application_user_claims, dependent: :destroy
  has_many :oidc_user_consents, dependent: :destroy
  has_many :webauthn_credentials, dependent: :destroy

@@ -15,15 +19,23 @@ class User < ApplicationRecord
    updated_at
  end

-  generates_token_for :magic_login, expires_in: 15.minutes do
-    last_sign_in_at
-  end
-
  normalizes :email_address, with: ->(e) { e.strip.downcase }
+  normalizes :username, with: ->(u) { u.strip.downcase if u.present? }
+
+  # Reserved OIDC claim names that should not be overridden
+  RESERVED_CLAIMS = %w[
+    iss sub aud exp iat nbf jti nonce azp
+    email email_verified preferred_username name
+    groups
+  ].freeze

  validates :email_address, presence: true, uniqueness: { case_sensitive: false },
                           format: { with: URI::MailTo::EMAIL_REGEXP }
+  validates :username, uniqueness: { case_sensitive: false }, allow_nil: true,
+                      format: { with: /\A[a-zA-Z0-9_-]+\z/, message: "can only contain letters, numbers, underscores, and hyphens" },
+                      length: { minimum: 2, maximum: 30 }
  validates :password, length: { minimum: 8 }, allow_nil: true
+  validate :no_reserved_claim_names

  # Enum - automatically creates scopes (User.active, User.disabled, etc.)
  enum :status, { active: 0, disabled: 1, pending_invitation: 2 }
@@ -44,7 +56,9 @@ class User < ApplicationRecord
  end

  def disable_totp!
-    update!(totp_secret: nil, totp_required: false, backup_codes: nil)
+    # Note: This does NOT clear totp_required flag
+    # Admins control that flag via admin panel, users cannot remove admin-required 2FA
+    update!(totp_secret: nil, backup_codes: nil)
  end

  def totp_provisioning_uri(issuer: "Clinch")
@@ -63,6 +77,14 @@ class User < ApplicationRecord
    totp.verify(code, drift_behind: 30, drift_ahead: 30)
  end

+  # Console/debug helper: get current TOTP code
+  def console_totp
+    return nil unless totp_enabled?
+
+    require "rotp"
+    ROTP::TOTP.new(totp_secret).now
+  end
+
  def verify_backup_code(code)
    return false unless backup_codes.present?

@@ -180,11 +202,39 @@ class User < ApplicationRecord

  # Parse custom_claims JSON field
  def parsed_custom_claims
-    custom_claims || {}
+    return {} if custom_claims.blank?
+    custom_claims.is_a?(Hash) ? custom_claims : {}
+  end
+
+  # Get fully merged claims for a specific application
+  def merged_claims_for_application(application)
+    merged = {}
+
+    # Start with group claims (in order)
+    groups.each do |group|
+      merged.merge!(group.parsed_custom_claims)
+    end
+
+    # Merge user global claims
+    merged.merge!(parsed_custom_claims)
+
+    # Merge app-specific claims (highest priority)
+    merged.merge!(application.custom_claims_for_user(self))
+
+    merged
  end

  private

+  def no_reserved_claim_names
+    return if custom_claims.blank?
+
+    reserved_used = parsed_custom_claims.keys.map(&:to_s) & RESERVED_CLAIMS
+    if reserved_used.any?
+      errors.add(:custom_claims, "cannot override reserved OIDC claims: #{reserved_used.join(', ')}")
+    end
+  end
+
  def generate_backup_codes
    # Generate plain codes for user to see/save
    plain_codes = Array.new(10) { SecureRandom.alphanumeric(8).upcase }
--- a/app/services/concerns/claims_merger.rb
+++ b/app/services/concerns/claims_merger.rb
@@ -0,0 +1,35 @@
+module ClaimsMerger
+  extend ActiveSupport::Concern
+
+  # Deep merge claims, combining arrays instead of overwriting them
+  # This ensures that array values (like roles) are combined across group/user/app claims
+  #
+  # Example:
+  #   base = { "roles" => ["user"], "level" => 1 }
+  #   incoming = { "roles" => ["admin"], "department" => "IT" }
+  #   deep_merge_claims(base, incoming)
+  #   # => { "roles" => ["user", "admin"], "level" => 1, "department" => "IT" }
+  def deep_merge_claims(base, incoming)
+    result = base.dup
+
+    incoming.each do |key, value|
+      if result.key?(key)
+        # If both values are arrays, combine them (union to avoid duplicates)
+        if result[key].is_a?(Array) && value.is_a?(Array)
+          result[key] = (result[key] + value).uniq
+        # If both values are hashes, recursively merge them
+        elsif result[key].is_a?(Hash) && value.is_a?(Hash)
+          result[key] = deep_merge_claims(result[key], value)
+        else
+          # Otherwise, incoming value wins (override)
+          result[key] = value
+        end
+      else
+        # New key, just add it
+        result[key] = value
+      end
+    end
+
+    result
+  end
+end
--- a/app/services/oidc_jwt_service.rb
+++ b/app/services/oidc_jwt_service.rb
@@ -1,40 +1,79 @@
 class OidcJwtService
+  extend ClaimsMerger
+
  class << self
    # Generate an ID token (JWT) for the user
-    def generate_id_token(user, application, nonce: nil)
+    def generate_id_token(user, application, consent: nil, nonce: nil, access_token: nil)
      now = Time.current.to_i
+      # Use application's configured ID token TTL (defaults to 1 hour)
+      ttl = application.id_token_expiry_seconds
+
+      # Use pairwise SID from consent if available, fallback to user ID
+      subject = consent&.sid || user.id.to_s

      payload = {
        iss: issuer_url,
-        sub: user.id.to_s,
+        sub: subject,
        aud: application.client_id,
-        exp: now + 3600, # 1 hour
+        exp: now + ttl,
        iat: now,
        email: user.email_address,
        email_verified: true,
-        preferred_username: user.email_address,
+        preferred_username: user.username.presence || user.email_address,
        name: user.name.presence || user.email_address
      }

      # Add nonce if provided (OIDC requires this for implicit flow)
      payload[:nonce] = nonce if nonce.present?

+      # Add at_hash if access token is provided (OIDC Core spec §3.1.3.6)
+      # at_hash = left-most 128 bits of SHA-256 hash of access token, base64url encoded
+      if access_token.present?
+        sha256 = Digest::SHA256.digest(access_token)
+        at_hash = Base64.urlsafe_encode64(sha256[0..15], padding: false)
+        payload[:at_hash] = at_hash
+      end
+
      # Add groups if user has any
      if user.groups.any?
        payload[:groups] = user.groups.pluck(:name)
      end

-      # Add admin claim if user is admin
-      payload[:admin] = true if user.admin?
-
-      # Merge custom claims from groups
+      # Merge custom claims from groups (arrays are combined, not overwritten)
      user.groups.each do |group|
-        payload.merge!(group.parsed_custom_claims)
+        payload = deep_merge_claims(payload, group.parsed_custom_claims)
      end

-      # Merge custom claims from user (overrides group claims)
-      payload.merge!(user.parsed_custom_claims)
+      # Merge custom claims from user (arrays are combined, other values override)
+      payload = deep_merge_claims(payload, user.parsed_custom_claims)

+      # Merge app-specific custom claims (highest priority, arrays are combined)
+      payload = deep_merge_claims(payload, application.custom_claims_for_user(user))
+
+      JWT.encode(payload, private_key, "RS256", { kid: key_id, typ: "JWT" })
+    end
+
+    # Generate a backchannel logout token (JWT)
+    # Per OIDC Back-Channel Logout spec, this token:
+    # - MUST include iss, aud, iat, jti, events claims
+    # - MUST include sub or sid (or both) - we always include both
+    # - MUST NOT include nonce claim
+    def generate_logout_token(user, application, consent)
+      now = Time.current.to_i
+
+      payload = {
+        iss: issuer_url,
+        sub: consent.sid,  # Pairwise subject identifier
+        aud: application.client_id,
+        iat: now,
+        jti: SecureRandom.uuid,  # Unique identifier for this logout token
+        sid: consent.sid,  # Session ID - always included for granular logout
+        events: {
+          "http://schemas.openid.net/event/backchannel-logout" => {}
+        }
+      }
+
+      # Important: Do NOT include nonce in logout tokens (spec requirement)
      JWT.encode(payload, private_key, "RS256", { kid: key_id, typ: "JWT" })
    end

@@ -63,7 +102,14 @@ class OidcJwtService
    def issuer_url
      # In production, this should come from ENV or config
      # For now, we'll use a placeholder that can be overridden
-      "https://#{ENV.fetch("CLINCH_HOST", "localhost:3000")}"
+      host = ENV.fetch("CLINCH_HOST", "localhost:3000")
+      # Ensure URL has protocol - use https:// in production, http:// in development
+      if host.match?(/^https?:\/\//)
+        host
+      else
+        protocol = Rails.env.production? ? "https" : "http"
+        "#{protocol}://#{host}"
+      end
    end

    private
@@ -71,17 +117,37 @@ class OidcJwtService
    # Get or generate RSA private key
    def private_key
      @private_key ||= begin
+        key_source = nil
+
        # Try ENV variable first (best for Docker/Kamal)
        if ENV["OIDC_PRIVATE_KEY"].present?
-          OpenSSL::PKey::RSA.new(ENV["OIDC_PRIVATE_KEY"])
+          key_source = ENV["OIDC_PRIVATE_KEY"]
        # Then try Rails credentials
        elsif Rails.application.credentials.oidc_private_key.present?
-          OpenSSL::PKey::RSA.new(Rails.application.credentials.oidc_private_key)
+          key_source = Rails.application.credentials.oidc_private_key
+        end
+
+        if key_source.present?
+          begin
+            # Handle both actual newlines and escaped \n sequences
+            # Some .env loaders may escape newlines, so we need to convert them back
+            key_data = key_source.gsub("\\n", "\n")
+            OpenSSL::PKey::RSA.new(key_data)
+          rescue OpenSSL::PKey::RSAError => e
+            Rails.logger.error "OIDC: Failed to load private key: #{e.message}"
+            Rails.logger.error "OIDC: Key source length: #{key_source.length}, starts with: #{key_source[0..50]}"
+            raise "Invalid OIDC private key format. Please ensure the key is in PEM format with proper newlines."
+          end
        else
-          # Generate a new key for development
-          # In production, you MUST set OIDC_PRIVATE_KEY env var or add to credentials
+          # In production, we should never generate a key on the fly
+          # because it would be different across servers/deployments
+          if Rails.env.production?
+            raise "OIDC private key not configured. Set OIDC_PRIVATE_KEY environment variable or add to Rails credentials."
+          end
+
+          # Generate a new key for development/test only
          Rails.logger.warn "OIDC: No private key found in ENV or credentials, generating new key (development only)"
-          Rails.logger.warn "OIDC: Set OIDC_PRIVATE_KEY environment variable in production!"
+          Rails.logger.warn "OIDC: Set OIDC_PRIVATE_KEY environment variable for consistency across restarts"
          OpenSSL::PKey::RSA.new(2048)
        end
      end
--- a/app/views/admin/applications/_form.html.erb
+++ b/app/views/admin/applications/_form.html.erb
@@ -17,6 +17,87 @@
    <%= form.text_area :description, rows: 3, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "Optional description of this application" %>
  </div>

+  <div>
+    <div class="flex items-center justify-between">
+      <%= form.label :icon, "Application Icon", class: "block text-sm font-medium text-gray-700" %>
+      <a href="https://dashboardicons.com" target="_blank" rel="noopener noreferrer" class="text-xs text-blue-600 hover:text-blue-800 flex items-center gap-1">
+        <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"></path>
+        </svg>
+        Browse icons at dashboardicons.com
+      </a>
+    </div>
+    <% if application.icon.attached? && application.persisted? %>
+      <% begin %>
+        <%# Only show icon if we can successfully get its URL (blob is persisted) %>
+        <% if application.icon.blob&.persisted? && application.icon.blob.key.present? %>
+          <div class="mt-2 mb-3 flex items-center gap-4">
+            <%= image_tag application.icon, class: "h-16 w-16 rounded-lg object-cover border border-gray-200", alt: "Current icon" %>
+            <div class="text-sm text-gray-600">
+              <p class="font-medium">Current icon</p>
+              <p class="text-xs"><%= number_to_human_size(application.icon.blob.byte_size) %></p>
+            </div>
+          </div>
+        <% end %>
+      <% rescue ArgumentError => e %>
+        <%# Handle case where icon attachment exists but can't generate signed_id %>
+        <% if e.message.include?("Cannot get a signed_id for a new record") %>
+          <div class="mt-2 mb-3 text-sm text-gray-600">
+            <p class="font-medium">Icon uploaded</p>
+            <p class="text-xs">File will be processed shortly</p>
+          </div>
+        <% else %>
+          <%# Re-raise if it's a different error %>
+          <% raise e %>
+        <% end %>
+      <% end %>
+    <% end %>
+
+    <div class="mt-2" data-controller="file-drop image-paste">
+      <div class="flex justify-center px-6 pt-5 pb-6 border-2 border-gray-300 border-dashed rounded-md hover:border-blue-400 transition-colors"
+           data-file-drop-target="dropzone"
+           data-image-paste-target="dropzone"
+           data-action="dragover->file-drop#dragover dragleave->file-drop#dragleave drop->file-drop#drop paste->image-paste#handlePaste"
+           tabindex="0">
+        <div class="space-y-1 text-center">
+          <svg class="mx-auto h-12 w-12 text-gray-400" stroke="currentColor" fill="none" viewBox="0 0 48 48">
+            <path d="M28 8H12a4 4 0 00-4 4v20m32-12v8m0 0v8a4 4 0 01-4 4H12a4 4 0 01-4-4v-4m32-4l-3.172-3.172a4 4 0 00-5.656 0L28 28M8 32l9.172-9.172a4 4 0 015.656 0L28 28m0 0l4 4m4-24h8m-4-4v8m-12 4h.02" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />
+          </svg>
+          <div class="flex text-sm text-gray-600">
+            <label for="<%= form.field_id(:icon) %>" class="relative cursor-pointer bg-white rounded-md font-medium text-blue-600 hover:text-blue-500 focus-within:outline-none focus-within:ring-2 focus-within:ring-offset-2 focus-within:ring-blue-500">
+              <span>Upload a file</span>
+              <%= form.file_field :icon,
+                  accept: "image/png,image/jpg,image/jpeg,image/gif,image/svg+xml",
+                  class: "sr-only",
+                  data: {
+                    file_drop_target: "input",
+                    image_paste_target: "input",
+                    action: "change->file-drop#handleFiles"
+                  } %>
+            </label>
+            <p class="pl-1">or drag and drop</p>
+          </div>
+          <p class="text-xs text-gray-500">PNG, JPG, GIF, or SVG up to 2MB</p>
+          <p class="text-xs text-blue-600 font-medium mt-2">💡 Tip: Click here and press Ctrl+V (or Cmd+V) to paste an image from your clipboard</p>
+        </div>
+      </div>
+      <div data-file-drop-target="preview" class="mt-3 hidden">
+        <div class="flex items-center gap-3 p-3 bg-blue-50 rounded-md border border-blue-200">
+          <img data-file-drop-target="previewImage" class="h-12 w-12 rounded object-cover" alt="Preview">
+          <div class="flex-1 min-w-0">
+            <p class="text-sm font-medium text-gray-900" data-file-drop-target="filename"></p>
+            <p class="text-xs text-gray-500" data-file-drop-target="filesize"></p>
+          </div>
+          <button type="button" data-action="click->file-drop#clear" class="text-gray-400 hover:text-gray-600">
+            <svg class="h-5 w-5" fill="currentColor" viewBox="0 0 20 20">
+              <path fill-rule="evenodd" d="M4.293 4.293a1 1 0 011.414 0L10 8.586l4.293-4.293a1 1 0 111.414 1.414L11.414 10l4.293 4.293a1 1 0 01-1.414 1.414L10 11.414l-4.293 4.293a1 1 0 01-1.414-1.414L8.586 10 4.293 5.707a1 1 0 010-1.414z" clip-rule="evenodd" />
+            </svg>
+          </button>
+        </div>
+      </div>
+    </div>
+  </div>
+
  <div>
    <%= form.label :landing_url, "Landing URL", class: "block text-sm font-medium text-gray-700" %>
    <%= form.url_field :landing_url, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "https://app.example.com" %>
@@ -39,11 +120,113 @@
  <div id="oidc-fields" class="space-y-6 border-t border-gray-200 pt-6 <%= 'hidden' unless application.oidc? || !application.persisted? %>" data-application-form-target="oidcFields">
    <h3 class="text-base font-semibold text-gray-900">OIDC Configuration</h3>

+    <!-- Client Type Selection (only for new applications) -->
+    <% unless application.persisted? %>
+    <div class="border border-gray-200 rounded-lg p-4 bg-gray-50">
+      <h4 class="text-sm font-semibold text-gray-900 mb-3">Client Type</h4>
+      <div class="space-y-3">
+        <div class="flex items-start">
+          <%= form.radio_button :is_public_client, "false", checked: !application.is_public_client, class: "mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500", data: { action: "change->application-form#updatePkceVisibility" } %>
+          <div class="ml-3">
+            <label for="application_is_public_client_false" class="block text-sm font-medium text-gray-900">Confidential Client (Recommended)</label>
+            <p class="text-sm text-gray-500">Backend server app that can securely store a client secret. Examples: traditional web apps, server-to-server APIs.</p>
+          </div>
+        </div>
+        <div class="flex items-start">
+          <%= form.radio_button :is_public_client, "true", checked: application.is_public_client, class: "mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500", data: { action: "change->application-form#updatePkceVisibility" } %>
+          <div class="ml-3">
+            <label for="application_is_public_client_true" class="block text-sm font-medium text-gray-900">Public Client</label>
+            <p class="text-sm text-gray-500">Frontend-only app that cannot store secrets securely. Examples: SPAs (React/Vue), mobile apps, CLI tools. <strong class="text-amber-600">PKCE is required.</strong></p>
+          </div>
+        </div>
+      </div>
+    </div>
+    <% else %>
+    <!-- Show client type for existing applications (read-only) -->
+    <div class="flex items-center gap-2 text-sm">
+      <span class="font-medium text-gray-700">Client Type:</span>
+      <% if application.public_client? %>
+        <span class="inline-flex items-center rounded-md bg-amber-50 px-2 py-1 text-xs font-medium text-amber-700 ring-1 ring-inset ring-amber-600/20">Public Client (PKCE Required)</span>
+      <% else %>
+        <span class="inline-flex items-center rounded-md bg-green-50 px-2 py-1 text-xs font-medium text-green-700 ring-1 ring-inset ring-green-600/20">Confidential Client</span>
+      <% end %>
+    </div>
+    <% end %>
+
+    <!-- PKCE Requirement (only for confidential clients) -->
+    <div id="pkce-options" data-application-form-target="pkceOptions" class="<%= 'hidden' if application.persisted? && application.public_client? %>">
+      <div class="flex items-center">
+        <%= form.check_box :require_pkce, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
+        <%= form.label :require_pkce, "Require PKCE (Proof Key for Code Exchange)", class: "ml-2 block text-sm font-medium text-gray-900" %>
+      </div>
+      <p class="ml-6 text-sm text-gray-500">
+        Recommended for enhanced security (OAuth 2.1 best practice).
+        <br><span class="text-xs text-gray-400">Note: Public clients always require PKCE regardless of this setting.</span>
+      </p>
+    </div>
+
    <div>
      <%= form.label :redirect_uris, "Redirect URIs", class: "block text-sm font-medium text-gray-700" %>
      <%= form.text_area :redirect_uris, rows: 4, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm font-mono", placeholder: "https://example.com/callback\nhttps://app.example.com/auth/callback" %>
      <p class="mt-1 text-sm text-gray-500">One URI per line. These are the allowed callback URLs for your application.</p>
    </div>
+
+    <div>
+      <%= form.label :backchannel_logout_uri, "Backchannel Logout URI (Optional)", class: "block text-sm font-medium text-gray-700" %>
+      <%= form.url_field :backchannel_logout_uri, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm font-mono", placeholder: "https://app.example.com/oidc/backchannel-logout" %>
+      <p class="mt-1 text-sm text-gray-500">
+        If the application supports OpenID Connect Backchannel Logout, enter the logout endpoint URL.
+        When users log out, Clinch will send logout notifications to this endpoint for immediate session termination.
+        Leave blank if the application doesn't support backchannel logout.
+      </p>
+    </div>
+
+    <div class="border-t border-gray-200 pt-4 mt-4">
+      <h4 class="text-sm font-semibold text-gray-900 mb-3">Token Expiration Settings</h4>
+      <p class="text-sm text-gray-500 mb-4">Configure how long tokens remain valid. Shorter times are more secure but require more frequent refreshes.</p>
+
+      <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+        <div>
+          <%= form.label :access_token_ttl, "Access Token TTL (seconds)", class: "block text-sm font-medium text-gray-700" %>
+          <%= form.number_field :access_token_ttl, value: application.access_token_ttl || 3600, min: 300, max: 86400, step: 60, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
+          <p class="mt-1 text-xs text-gray-500">
+            Range: 5 min - 24 hours
+            <br>Default: 1 hour (3600s)
+            <br>Current: <span class="font-medium"><%= application.access_token_ttl_human || "1 hour" %></span>
+          </p>
+        </div>
+
+        <div>
+          <%= form.label :refresh_token_ttl, "Refresh Token TTL (seconds)", class: "block text-sm font-medium text-gray-700" %>
+          <%= form.number_field :refresh_token_ttl, value: application.refresh_token_ttl || 2592000, min: 86400, max: 7776000, step: 86400, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
+          <p class="mt-1 text-xs text-gray-500">
+            Range: 1 day - 90 days
+            <br>Default: 30 days (2592000s)
+            <br>Current: <span class="font-medium"><%= application.refresh_token_ttl_human || "30 days" %></span>
+          </p>
+        </div>
+
+        <div>
+          <%= form.label :id_token_ttl, "ID Token TTL (seconds)", class: "block text-sm font-medium text-gray-700" %>
+          <%= form.number_field :id_token_ttl, value: application.id_token_ttl || 3600, min: 300, max: 86400, step: 60, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
+          <p class="mt-1 text-xs text-gray-500">
+            Range: 5 min - 24 hours
+            <br>Default: 1 hour (3600s)
+            <br>Current: <span class="font-medium"><%= application.id_token_ttl_human || "1 hour" %></span>
+          </p>
+        </div>
+      </div>
+
+      <details class="mt-3">
+        <summary class="cursor-pointer text-sm text-blue-600 hover:text-blue-800">Understanding Token Types</summary>
+        <div class="mt-2 ml-4 space-y-2 text-sm text-gray-600">
+          <p><strong>Access Token:</strong> Used to access protected resources (APIs). Shorter lifetime = more secure. Users won't notice automatic refreshes.</p>
+          <p><strong>Refresh Token:</strong> Used to get new access tokens without re-authentication. Longer lifetime = better UX (less re-logins).</p>
+          <p><strong>ID Token:</strong> Contains user identity information (JWT). Should match access token lifetime in most cases.</p>
+          <p class="text-xs italic mt-2">💡 Tip: Banking apps use 5-15 min access tokens. Internal tools use 1-4 hours.</p>
+        </div>
+      </details>
+    </div>
  </div>

  <!-- Forward Auth-specific fields -->
--- a/app/views/admin/applications/index.html.erb
+++ b/app/views/admin/applications/index.html.erb
@@ -14,7 +14,7 @@
      <table class="min-w-full divide-y divide-gray-300">
        <thead>
          <tr>
-            <th scope="col" class="py-3.5 pl-4 pr-3 text-left text-sm font-semibold text-gray-900 sm:pl-0">Name</th>
+            <th scope="col" class="py-3.5 pl-4 pr-3 text-left text-sm font-semibold text-gray-900 sm:pl-0">Application</th>
            <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Slug</th>
            <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Type</th>
            <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Status</th>
@@ -28,7 +28,18 @@
          <% @applications.each do |application| %>
            <tr>
              <td class="whitespace-nowrap py-4 pl-4 pr-3 text-sm font-medium text-gray-900 sm:pl-0">
+                <div class="flex items-center gap-3">
+                  <% if application.icon.attached? %>
+                    <%= image_tag application.icon, class: "h-10 w-10 rounded-lg object-cover border border-gray-200 flex-shrink-0", alt: "#{application.name} icon" %>
+                  <% else %>
+                    <div class="h-10 w-10 rounded-lg bg-gray-100 border border-gray-200 flex items-center justify-center flex-shrink-0">
+                      <svg class="h-6 w-6 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16l4.586-4.586a2 2 0 012.828 0L16 16m-2-2l1.586-1.586a2 2 0 012.828 0L20 14m-6-6h.01M6 20h12a2 2 0 002-2V6a2 2 0 00-2-2H6a2 2 0 00-2 2v12a2 2 0 002 2z" />
+                      </svg>
+                    </div>
+                  <% end %>
                  <%= link_to application.name, admin_application_path(application), class: "text-blue-600 hover:text-blue-900" %>
+                </div>
              </td>
              <td class="whitespace-nowrap px-3 py-4 text-sm text-gray-500">
                <code class="text-xs bg-gray-100 px-2 py-1 rounded"><%= application.slug %></code>
@@ -37,6 +48,8 @@
                <% case application.app_type %>
                <% when "oidc" %>
                  <span class="inline-flex items-center rounded-full bg-purple-100 px-2 py-1 text-xs font-medium text-purple-700">OIDC</span>
+                <% when "forward_auth" %>
+                  <span class="inline-flex items-center rounded-full bg-blue-100 px-2 py-1 text-xs font-medium text-blue-700">Forward Auth</span>
                <% when "saml" %>
                  <span class="inline-flex items-center rounded-full bg-orange-100 px-2 py-1 text-xs font-medium text-orange-700">SAML</span>
                <% end %>
--- a/app/views/admin/applications/show.html.erb
+++ b/app/views/admin/applications/show.html.erb
@@ -1,26 +1,50 @@
 <div class="mb-6">
-  <% if flash[:client_id] && flash[:client_secret] %>
+  <% if flash[:client_id] %>
    <div class="bg-yellow-50 border border-yellow-200 rounded-md p-4 mb-6">
      <h4 class="text-sm font-medium text-yellow-800 mb-2">🔐 OIDC Client Credentials</h4>
+      <% if flash[:public_client] %>
+        <p class="text-xs text-yellow-700 mb-3">This is a public client. Copy the client ID below.</p>
+      <% else %>
        <p class="text-xs text-yellow-700 mb-3">Copy these credentials now. The client secret will not be shown again.</p>
+      <% end %>
      <div class="space-y-2">
        <div>
          <span class="text-xs font-medium text-yellow-700">Client ID:</span>
        </div>
        <code class="block bg-yellow-100 px-3 py-2 rounded font-mono text-xs break-all"><%= flash[:client_id] %></code>
+        <% if flash[:client_secret] %>
          <div class="mt-3">
            <span class="text-xs font-medium text-yellow-700">Client Secret:</span>
          </div>
          <code class="block bg-yellow-100 px-3 py-2 rounded font-mono text-xs break-all"><%= flash[:client_secret] %></code>
+        <% elsif flash[:public_client] %>
+          <div class="mt-3">
+            <span class="text-xs font-medium text-yellow-700">Client Secret:</span>
+          </div>
+          <div class="bg-yellow-100 px-3 py-2 rounded text-xs text-yellow-600">
+            Public clients do not have a client secret. PKCE is required.
+          </div>
+        <% end %>
      </div>
    </div>
  <% end %>

-  <div class="sm:flex sm:items-center sm:justify-between">
+  <div class="sm:flex sm:items-start sm:justify-between">
+    <div class="flex items-start gap-4">
+      <% if @application.icon.attached? %>
+        <%= image_tag @application.icon, class: "h-16 w-16 rounded-lg object-cover border border-gray-200 shrink-0", alt: "#{@application.name} icon" %>
+      <% else %>
+        <div class="h-16 w-16 rounded-lg bg-gray-100 border border-gray-200 flex items-center justify-center shrink-0">
+          <svg class="h-8 w-8 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16l4.586-4.586a2 2 0 012.828 0L16 16m-2-2l1.586-1.586a2 2 0 012.828 0L20 14m-6-6h.01M6 20h12a2 2 0 002-2V6a2 2 0 00-2-2H6a2 2 0 00-2 2v12a2 2 0 002 2z" />
+          </svg>
+        </div>
+      <% end %>
      <div>
        <h1 class="text-2xl font-semibold text-gray-900"><%= @application.name %></h1>
        <p class="mt-1 text-sm text-gray-500"><%= @application.description %></p>
      </div>
+    </div>
    <div class="mt-4 sm:mt-0 flex gap-3">
      <%= link_to "Edit", edit_admin_application_path(@application), class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50" %>
      <%= button_to "Delete", admin_application_path(@application), method: :delete, data: { turbo_confirm: "Are you sure?" }, class: "rounded-md bg-red-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-red-500" %>
@@ -78,16 +102,40 @@
    <div class="bg-white shadow sm:rounded-lg">
      <div class="px-4 py-5 sm:p-6">
        <div class="flex items-center justify-between mb-4">
-          <h3 class="text-base font-semibold leading-6 text-gray-900">OIDC Credentials</h3>
+          <h3 class="text-base font-semibold leading-6 text-gray-900">OIDC Configuration</h3>
          <%= button_to "Regenerate Credentials", regenerate_credentials_admin_application_path(@application), method: :post, data: { turbo_confirm: "This will invalidate the current credentials. Continue?" }, class: "text-sm text-red-600 hover:text-red-900" %>
        </div>
        <dl class="space-y-4">
+          <div class="grid grid-cols-2 gap-4">
+            <div>
+              <dt class="text-sm font-medium text-gray-500">Client Type</dt>
+              <dd class="mt-1 text-sm text-gray-900">
+                <% if @application.public_client? %>
+                  <span class="inline-flex items-center rounded-full bg-blue-100 px-2 py-1 text-xs font-medium text-blue-700">Public</span>
+                <% else %>
+                  <span class="inline-flex items-center rounded-full bg-gray-100 px-2 py-1 text-xs font-medium text-gray-700">Confidential</span>
+                <% end %>
+              </dd>
+            </div>
+            <div>
+              <dt class="text-sm font-medium text-gray-500">PKCE</dt>
+              <dd class="mt-1 text-sm text-gray-900">
+                <% if @application.requires_pkce? %>
+                  <span class="inline-flex items-center rounded-full bg-green-100 px-2 py-1 text-xs font-medium text-green-700">Required</span>
+                <% else %>
+                  <span class="inline-flex items-center rounded-full bg-gray-100 px-2 py-1 text-xs font-medium text-gray-700">Optional</span>
+                <% end %>
+              </dd>
+            </div>
+          </div>
+          <% unless flash[:client_id] %>
            <div>
              <dt class="text-sm font-medium text-gray-500">Client ID</dt>
              <dd class="mt-1 text-sm text-gray-900">
                <code class="block bg-gray-100 px-3 py-2 rounded font-mono text-xs break-all"><%= @application.client_id %></code>
              </dd>
            </div>
+            <% if @application.confidential_client? %>
              <div>
                <dt class="text-sm font-medium text-gray-500">Client Secret</dt>
                <dd class="mt-1 text-sm text-gray-900">
@@ -99,6 +147,17 @@
                  </p>
                </dd>
              </div>
+            <% else %>
+              <div>
+                <dt class="text-sm font-medium text-gray-500">Client Secret</dt>
+                <dd class="mt-1 text-sm text-gray-900">
+                  <div class="bg-blue-50 px-3 py-2 rounded text-xs text-blue-600">
+                    Public clients do not use a client secret. PKCE is required for authorization.
+                  </div>
+                </dd>
+              </div>
+            <% end %>
+          <% end %>
          <div>
            <dt class="text-sm font-medium text-gray-500">Redirect URIs</dt>
            <dd class="mt-1 text-sm text-gray-900">
@@ -111,6 +170,27 @@
              <% end %>
            </dd>
          </div>
+          <div>
+            <dt class="text-sm font-medium text-gray-500">
+              Backchannel Logout URI
+              <% if @application.supports_backchannel_logout? %>
+                <span class="ml-2 inline-flex items-center rounded-full bg-green-100 px-2 py-0.5 text-xs font-medium text-green-700">Enabled</span>
+              <% end %>
+            </dt>
+            <dd class="mt-1 text-sm text-gray-900">
+              <% if @application.backchannel_logout_uri.present? %>
+                <code class="block bg-gray-100 px-3 py-2 rounded font-mono text-xs break-all"><%= @application.backchannel_logout_uri %></code>
+                <p class="mt-2 text-xs text-gray-500">
+                  When users log out, Clinch will send logout notifications to this endpoint for immediate session termination.
+                </p>
+              <% else %>
+                <span class="text-gray-400 italic">Not configured</span>
+                <p class="mt-1 text-xs text-gray-500">
+                  Backchannel logout is optional. Configure it if the application supports OpenID Connect Backchannel Logout.
+                </p>
+              <% end %>
+            </dd>
+          </div>
        </dl>
      </div>
    </div>
--- a/app/views/admin/groups/index.html.erb
+++ b/app/views/admin/groups/index.html.erb
@@ -39,9 +39,11 @@
                <%= pluralize(group.applications.count, "app") %>
              </td>
              <td class="relative whitespace-nowrap py-4 pl-3 pr-4 text-right text-sm font-medium sm:pr-0">
-                <%= link_to "View", admin_group_path(group), class: "text-blue-600 hover:text-blue-900 mr-4" %>
-                <%= link_to "Edit", edit_admin_group_path(group), class: "text-blue-600 hover:text-blue-900 mr-4" %>
-                <%= button_to "Delete", admin_group_path(group), method: :delete, data: { turbo_confirm: "Are you sure you want to delete this group?" }, class: "text-red-600 hover:text-red-900" %>
+                <div class="flex justify-end space-x-3">
+                  <%= link_to "View", admin_group_path(group), class: "text-blue-600 hover:text-blue-900 whitespace-nowrap" %>
+                  <%= link_to "Edit", edit_admin_group_path(group), class: "text-blue-600 hover:text-blue-900 whitespace-nowrap" %>
+                  <%= button_to "Delete", admin_group_path(group), method: :delete, data: { turbo_confirm: "Are you sure you want to delete this group?" }, class: "text-red-600 hover:text-red-900 whitespace-nowrap" %>
+                </div>
              </td>
            </tr>
          <% end %>
--- a/app/views/admin/users/_application_claims.html.erb
+++ b/app/views/admin/users/_application_claims.html.erb
@@ -0,0 +1,185 @@
+<% oidc_apps = applications.select(&:oidc?) %>
+<% forward_auth_apps = applications.select(&:forward_auth?) %>
+
+<!-- OIDC Apps: Custom Claims -->
+<% if oidc_apps.any? %>
+  <div class="mt-12 border-t pt-8">
+    <h2 class="text-xl font-semibold text-gray-900 mb-4">OIDC App-Specific Claims</h2>
+    <p class="text-sm text-gray-600 mb-6">
+      Configure custom claims that apply only to specific OIDC applications. These override both group and user global claims and are included in ID tokens.
+    </p>
+
+    <div class="space-y-6">
+      <% oidc_apps.each do |app| %>
+        <% app_claim = user.application_user_claims.find_by(application: app) %>
+        <details class="border rounded-lg" <%= "open" if app_claim&.custom_claims&.any? %>>
+          <summary class="cursor-pointer bg-gray-50 px-4 py-3 hover:bg-gray-100 rounded-t-lg flex items-center justify-between">
+            <div class="flex items-center gap-3">
+              <span class="font-medium text-gray-900"><%= app.name %></span>
+              <span class="text-xs px-2 py-1 rounded-full bg-blue-100 text-blue-700">
+                OIDC
+              </span>
+              <% if app_claim&.custom_claims&.any? %>
+                <span class="text-xs px-2 py-1 rounded-full bg-amber-100 text-amber-700">
+                  <%= app_claim.custom_claims.keys.count %> claim(s)
+                </span>
+              <% end %>
+            </div>
+            <svg class="h-5 w-5 text-gray-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+            </svg>
+          </summary>
+
+          <div class="p-4 space-y-4">
+            <%= form_with url: update_application_claims_admin_user_path(user), method: :post, class: "space-y-4", data: { controller: "json-validator" } do |form| %>
+              <%= hidden_field_tag :application_id, app.id %>
+
+              <div>
+                <label class="block text-sm font-medium text-gray-700 mb-2">Custom Claims (JSON)</label>
+                <%= text_area_tag :custom_claims,
+                    (app_claim&.custom_claims.present? ? JSON.pretty_generate(app_claim.custom_claims) : ""),
+                    rows: 8,
+                    class: "w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm font-mono",
+                    placeholder: '{"kavita_groups": ["admin"], "library_access": "all"}',
+                    data: {
+                      action: "input->json-validator#validate blur->json-validator#format",
+                      json_validator_target: "textarea"
+                    } %>
+                <div class="mt-2 space-y-1">
+                  <p class="text-xs text-gray-600">
+                    Example for <%= app.name %>: Add claims that this app specifically needs to read.
+                  </p>
+                  <p class="text-xs text-amber-600">
+                    <strong>Note:</strong> Do not use reserved claim names (<code class="bg-amber-50 px-1 rounded">groups</code>, <code class="bg-amber-50 px-1 rounded">email</code>, <code class="bg-amber-50 px-1 rounded">name</code>, etc.). Use app-specific names like <code class="bg-amber-50 px-1 rounded">kavita_groups</code> instead.
+                  </p>
+                  <div data-json-validator-target="status" class="text-xs font-medium"></div>
+                </div>
+              </div>
+
+              <div class="flex gap-3">
+                <%= button_tag type: :submit, class: "rounded-md bg-blue-600 px-3 py-2 text-sm font-semibold text-white shadow-sm hover:bg-blue-500" do %>
+                  <%= app_claim ? "Update" : "Add" %> Claims
+                <% end %>
+
+                <% if app_claim %>
+                  <%= button_to "Remove Override",
+                      delete_application_claims_admin_user_path(user, application_id: app.id),
+                      method: :delete,
+                      data: { turbo_confirm: "Remove app-specific claims for #{app.name}?" },
+                      class: "rounded-md bg-white px-3 py-2 text-sm font-semibold text-gray-900 shadow-sm ring-1 ring-inset ring-gray-300 hover:bg-gray-50" %>
+                <% end %>
+              </div>
+            <% end %>
+
+            <!-- Preview merged claims -->
+            <div class="mt-4 border-t pt-4">
+              <h4 class="text-sm font-medium text-gray-700 mb-2">Preview: Final ID Token Claims for <%= app.name %></h4>
+              <div class="bg-gray-50 rounded-lg p-3">
+                <pre class="text-xs font-mono text-gray-800 overflow-x-auto"><%= JSON.pretty_generate(preview_user_claims(user, app)) %></pre>
+              </div>
+
+              <details class="mt-2">
+                <summary class="cursor-pointer text-xs text-gray-600 hover:text-gray-900">Show claim sources</summary>
+                <div class="mt-2 space-y-1">
+                  <% claim_sources(user, app).each do |source| %>
+                    <div class="flex gap-2 items-start text-xs">
+                      <span class="px-2 py-1 rounded <%= source[:type] == :group ? 'bg-blue-100 text-blue-700' : (source[:type] == :user ? 'bg-green-100 text-green-700' : 'bg-amber-100 text-amber-700') %>">
+                        <%= source[:name] %>
+                      </span>
+                      <code class="text-gray-700"><%= source[:claims].to_json %></code>
+                    </div>
+                  <% end %>
+                </div>
+              </details>
+            </div>
+          </div>
+        </details>
+      <% end %>
+    </div>
+  </div>
+<% end %>
+
+<!-- ForwardAuth Apps: Headers Preview -->
+<% if forward_auth_apps.any? %>
+  <div class="mt-12 border-t pt-8">
+    <h2 class="text-xl font-semibold text-gray-900 mb-4">ForwardAuth Headers Preview</h2>
+    <p class="text-sm text-gray-600 mb-6">
+      ForwardAuth applications receive HTTP headers (not OIDC tokens). Headers are based on user's email, name, groups, and admin status.
+    </p>
+
+    <div class="space-y-6">
+      <% forward_auth_apps.each do |app| %>
+        <details class="border rounded-lg">
+          <summary class="cursor-pointer bg-gray-50 px-4 py-3 hover:bg-gray-100 rounded-t-lg flex items-center justify-between">
+            <div class="flex items-center gap-3">
+              <span class="font-medium text-gray-900"><%= app.name %></span>
+              <span class="text-xs px-2 py-1 rounded-full bg-green-100 text-green-700">
+                FORWARD AUTH
+              </span>
+              <span class="text-xs text-gray-500">
+                <%= app.domain_pattern %>
+              </span>
+            </div>
+            <svg class="h-5 w-5 text-gray-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+            </svg>
+          </summary>
+
+          <div class="p-4 space-y-4">
+            <div class="bg-blue-50 border border-blue-200 rounded-lg p-3">
+              <div class="flex items-start">
+                <svg class="h-5 w-5 text-blue-400 mr-2 flex-shrink-0 mt-0.5" fill="currentColor" viewBox="0 0 20 20">
+                  <path fill-rule="evenodd" d="M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7-4a1 1 0 11-2 0 1 1 0 012 0zM9 9a1 1 0 000 2v3a1 1 0 001 1h1a1 1 0 100-2v-3a1 1 0 00-1-1H9z" clip-rule="evenodd" />
+                </svg>
+              </div>
+            </div>
+
+            <div>
+              <h4 class="text-sm font-medium text-gray-700 mb-2">Headers Sent to <%= app.name %></h4>
+              <div class="bg-gray-50 rounded-lg p-3 border">
+                <% headers = app.headers_for_user(user) %>
+                <% if headers.any? %>
+                  <dl class="space-y-2 text-xs font-mono">
+                    <% headers.each do |header_name, value| %>
+                      <div class="flex">
+                        <dt class="text-blue-600 font-semibold w-48"><%= header_name %>:</dt>
+                        <dd class="text-gray-800 flex-1"><%= value %></dd>
+                      </div>
+                    <% end %>
+                  </dl>
+                <% else %>
+                  <p class="text-xs text-gray-500 italic">All headers disabled for this application.</p>
+                <% end %>
+              </div>
+              <p class="mt-2 text-xs text-gray-500">
+                These headers are configured in the application settings and sent by your reverse proxy (Caddy/Traefik) to the upstream application.
+              </p>
+            </div>
+
+            <% if user.groups.any? %>
+              <div>
+                <h4 class="text-sm font-medium text-gray-700 mb-2">User's Groups</h4>
+                <div class="flex flex-wrap gap-2">
+                  <% user.groups.each do |group| %>
+                    <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-blue-100 text-blue-800">
+                      <%= group.name %>
+                    </span>
+                  <% end %>
+                </div>
+              </div>
+            <% end %>
+          </div>
+        </details>
+      <% end %>
+    </div>
+  </div>
+<% end %>
+
+<% if oidc_apps.empty? && forward_auth_apps.empty? %>
+  <div class="mt-12 border-t pt-8">
+    <div class="text-center py-12 bg-gray-50 rounded-lg">
+      <p class="text-gray-500">No active applications found.</p>
+      <p class="text-sm text-gray-400 mt-1">Create applications in the Admin panel first.</p>
+    </div>
+  </div>
+<% end %>
--- a/app/views/admin/users/_form.html.erb
+++ b/app/views/admin/users/_form.html.erb
@@ -6,10 +6,16 @@
    <%= form.email_field :email_address, required: true, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "user@example.com" %>
  </div>

+  <div>
+    <%= form.label :username, "Username (Optional)", class: "block text-sm font-medium text-gray-700" %>
+    <%= form.text_field :username, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "jsmith" %>
+    <p class="mt-1 text-sm text-gray-500">Optional: Short username/handle for login. Can only contain letters, numbers, underscores, and hyphens.</p>
+  </div>
+
  <div>
    <%= form.label :name, "Display Name (Optional)", class: "block text-sm font-medium text-gray-700" %>
    <%= form.text_field :name, class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm", placeholder: "John Smith" %>
-    <p class="mt-1 text-sm text-gray-500">Optional: Name shown in applications. Defaults to email address if not set.</p>
+    <p class="mt-1 text-sm text-gray-500">Optional: Full name shown in applications. Defaults to email address if not set.</p>
  </div>

  <div>
@@ -35,6 +41,25 @@
    <% end %>
  </div>

+  <div>
+    <div class="flex items-center">
+      <%= form.check_box :totp_required, class: "h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500" %>
+      <%= form.label :totp_required, "Require Two-Factor Authentication", class: "ml-2 block text-sm text-gray-900" %>
+      <% if user.totp_required? && !user.totp_enabled? %>
+        <span class="ml-2 text-xs text-amber-600">(User has not set up 2FA yet)</span>
+      <% end %>
+    </div>
+    <% if user.totp_required? && !user.totp_enabled? %>
+      <p class="mt-1 text-sm text-amber-600">
+        <svg class="inline h-4 w-4" fill="currentColor" viewBox="0 0 20 20">
+          <path fill-rule="evenodd" d="M8.485 2.495c.673-1.167 2.357-1.167 3.03 0l6.28 10.875c.673 1.167-.17 2.625-1.516 2.625H3.72c-1.347 0-2.189-1.458-1.515-2.625L8.485 2.495zM10 5a.75.75 0 01.75.75v3.5a.75.75 0 01-1.5 0v-3.5A.75.75 0 0110 5zm0 9a1 1 0 100-2 1 1 0 000 2z" clip-rule="evenodd" />
+        </svg>
+        Warning: This user will be prompted to set up 2FA on their next login.
+      </p>
+    <% end %>
+    <p class="mt-1 text-sm text-gray-500">When enabled, this user must use two-factor authentication to sign in.</p>
+  </div>
+
  <div data-controller="json-validator" data-json-validator-valid-class="border-green-500 focus:border-green-500 focus:ring-green-500" data-json-validator-invalid-class="border-red-500 focus:border-red-500 focus:ring-red-500" data-json-validator-valid-status-class="text-green-600" data-json-validator-invalid-status-class="text-red-600">
    <%= form.label :custom_claims, "Custom Claims (JSON)", class: "block text-sm font-medium text-gray-700" %>
    <%= form.text_area :custom_claims, value: (user.custom_claims.present? ? JSON.pretty_generate(user.custom_claims) : ""), rows: 8,
--- a/app/views/admin/users/edit.html.erb
+++ b/app/views/admin/users/edit.html.erb
@@ -1,5 +1,12 @@
-<div class="max-w-2xl">
+<div class="max-w-4xl">
  <h1 class="text-2xl font-semibold text-gray-900 mb-6">Edit User</h1>
  <p class="text-sm text-gray-600 mb-6">Editing: <%= @user.email_address %></p>
+
+  <div class="max-w-2xl">
    <%= render "form", user: @user %>
+  </div>
+
+  <% if @user.persisted? %>
+    <%= render "application_claims", user: @user, applications: @applications %>
+  <% end %>
 </div>
--- a/app/views/admin/users/index.html.erb
+++ b/app/views/admin/users/index.html.erb
@@ -85,15 +85,20 @@
                <% end %>
              </td>
              <td class="whitespace-nowrap px-3 py-4 text-sm text-gray-500">
+                <div class="flex items-center gap-2">
                  <% if user.totp_enabled? %>
-                  <svg class="h-5 w-5 text-green-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <svg class="h-5 w-5 text-green-500" fill="none" stroke="currentColor" viewBox="0 0 24 24" title="2FA Enabled">
                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"></path>
                    </svg>
                  <% else %>
-                  <svg class="h-5 w-5 text-gray-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <svg class="h-5 w-5 text-gray-300" fill="none" stroke="currentColor" viewBox="0 0 24 24" title="2FA Not Enabled">
                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 14l2-2m0 0l2-2m-2 2l-2-2m2 2l2 2m7-2a9 9 0 11-18 0 9 9 0 0118 0z"></path>
                    </svg>
                  <% end %>
+                  <% if user.totp_required? %>
+                    <span class="inline-flex items-center rounded-full bg-blue-100 px-2 py-1 text-xs font-medium text-blue-700" title="2FA Required by Admin">Required</span>
+                  <% end %>
+                </div>
              </td>
              <td class="whitespace-nowrap px-3 py-4 text-sm text-gray-500">
                <%= user.groups.count %>
--- a/app/views/dashboard/index.html.erb
+++ b/app/views/dashboard/index.html.erb
@@ -102,11 +102,22 @@
      <% @applications.each do |app| %>
        <div class="bg-white rounded-lg border border-gray-200 shadow-sm hover:shadow-md transition">
          <div class="p-6">
-            <div class="flex items-center justify-between mb-3">
+            <div class="flex items-start gap-3 mb-4">
+              <% if app.icon.attached? %>
+                <%= image_tag app.icon, class: "h-12 w-12 rounded-lg object-cover border border-gray-200 shrink-0", alt: "#{app.name} icon" %>
+              <% else %>
+                <div class="h-12 w-12 rounded-lg bg-gray-100 border border-gray-200 flex items-center justify-center shrink-0">
+                  <svg class="h-6 w-6 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16l4.586-4.586a2 2 0 012.828 0L16 16m-2-2l1.586-1.586a2 2 0 012.828 0L20 14m-6-6h.01M6 20h12a2 2 0 002-2V6a2 2 0 00-2-2H6a2 2 0 00-2 2v12a2 2 0 002 2z" />
+                  </svg>
+                </div>
+              <% end %>
+              <div class="flex-1 min-w-0">
+                <div class="flex items-start justify-between">
                  <h3 class="text-lg font-semibold text-gray-900 truncate">
                    <%= app.name %>
                  </h3>
-              <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium
+                  <span class="ml-2 inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium shrink-0
                    <% if app.oidc? %>
                      bg-blue-100 text-blue-800
                    <% else %>
@@ -115,15 +126,15 @@
                    <%= app.app_type.humanize %>
                  </span>
                </div>
-
-            <p class="text-sm text-gray-600 mb-4">
-              <% if app.oidc? %>
-                OIDC Application
-              <% else %>
-                ForwardAuth Protected Application
-              <% end %>
+                <% if app.description.present? %>
+                  <p class="text-sm text-gray-600 mt-1 line-clamp-2">
+                    <%= app.description %>
                  </p>
+                <% end %>
+              </div>
+            </div>

+            <div class="space-y-2">
              <% if app.landing_url.present? %>
                <%= link_to "Open Application", app.landing_url,
                    target: "_blank",
@@ -134,6 +145,13 @@
                  No landing URL configured
                </div>
              <% end %>
+
+              <% if app.user_has_active_session?(@user) %>
+                <%= button_to "Logout", logout_from_app_active_sessions_path(application_id: app.id), method: :delete,
+                    class: "w-full flex justify-center items-center px-4 py-2 border border-orange-300 text-sm font-medium rounded-md text-orange-700 bg-white hover:bg-orange-50 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-orange-500 transition",
+                    form: { data: { turbo_confirm: "This will log you out of #{app.name}. You can sign back in without re-authorizing. Continue?" } } %>
+              <% end %>
+            </div>
          </div>
        </div>
      <% end %>
--- a/app/views/oidc/consent.html.erb
+++ b/app/views/oidc/consent.html.erb
@@ -1,6 +1,15 @@
 <div class="mx-auto max-w-md">
  <div class="bg-white py-8 px-6 shadow rounded-lg sm:px-10">
-    <div class="mb-8">
+    <div class="mb-8 text-center">
+      <% if @application.icon.attached? %>
+        <%= image_tag @application.icon, class: "mx-auto h-20 w-20 rounded-xl object-cover border-2 border-gray-200 shadow-sm mb-4", alt: "#{@application.name} icon" %>
+      <% else %>
+        <div class="mx-auto h-20 w-20 rounded-xl bg-gray-100 border-2 border-gray-200 flex items-center justify-center mb-4">
+          <svg class="h-10 w-10 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16l4.586-4.586a2 2 0 012.828 0L16 16m-2-2l1.586-1.586a2 2 0 012.828 0L20 14m-6-6h.01M6 20h12a2 2 0 002-2V6a2 2 0 00-2-2H6a2 2 0 00-2 2v12a2 2 0 002 2z" />
+          </svg>
+        </div>
+      <% end %>
      <h2 class="text-2xl font-bold text-gray-900">Authorize Application</h2>
      <p class="mt-2 text-sm text-gray-600">
        <strong><%= @application.name %></strong> is requesting access to your account.
@@ -57,7 +66,7 @@
      </div>
    </div>

-    <%= form_with url: oauth_consent_path, method: :post, class: "space-y-3", data: { turbo: false } do |form| %>
+    <%= form_with url: "/oauth/authorize/consent", method: :post, class: "space-y-3", data: { turbo: false }, local: true do |form| %>
      <%= form.submit "Authorize",
          class: "w-full flex justify-center py-2 px-4 border border-transparent rounded-md shadow-sm text-sm font-medium text-white bg-blue-600 hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-blue-500" %>

--- a/app/views/profiles/show.html.erb
+++ b/app/views/profiles/show.html.erb
@@ -31,6 +31,15 @@
                class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
          </div>

+          <div>
+            <%= form.label :current_password, "Current Password", class: "block text-sm font-medium text-gray-700" %>
+            <%= form.password_field :current_password,
+                autocomplete: "current-password",
+                placeholder: "Required to change email",
+                class: "mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500 sm:text-sm" %>
+            <p class="mt-1 text-sm text-gray-500">Enter your current password to confirm this change</p>
+          </div>
+
          <div>
            <%= form.submit "Update Email", class: "inline-flex justify-center rounded-md border border-transparent bg-blue-600 py-2 px-4 text-sm font-medium text-white shadow-sm hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2" %>
          </div>
@@ -98,9 +107,37 @@
                <p class="text-sm font-medium text-green-800">
                  Two-factor authentication is enabled
                </p>
+                <% if @user.totp_required? %>
+                  <p class="mt-1 text-sm text-green-700">
+                    <svg class="inline h-4 w-4" fill="currentColor" viewBox="0 0 20 20">
+                      <path fill-rule="evenodd" d="M5 9V7a5 5 0 0110 0v2a2 2 0 012 2v5a2 2 0 01-2 2H5a2 2 0 01-2-2v-5a2 2 0 012-2zm8-2v2H7V7a3 3 0 016 0z" clip-rule="evenodd" />
+                    </svg>
+                    Required by administrator
+                  </p>
+                <% end %>
              </div>
            </div>
          </div>
+          <% if @user.totp_required? %>
+            <div class="mt-4 rounded-md bg-blue-50 p-4">
+              <div class="flex">
+                <svg class="h-5 w-5 text-blue-400 mr-2 flex-shrink-0" viewBox="0 0 20 20" fill="currentColor">
+                  <path fill-rule="evenodd" d="M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7-4a1 1 0 11-2 0 1 1 0 012 0zM9 9a1 1 0 000 2v3a1 1 0 001 1h1a1 1 0 100-2v-3a1 1 0 00-1-1H9z" clip-rule="evenodd" />
+                </svg>
+                <p class="text-sm text-blue-800">
+                  Your administrator requires two-factor authentication. You cannot disable it.
+                </p>
+              </div>
+            </div>
+            <div class="mt-4 flex gap-3">
+              <button type="button"
+                      data-action="click->modal#show"
+                      data-modal-id="view-backup-codes-modal"
+                      class="inline-flex items-center rounded-md border border-gray-300 bg-white px-4 py-2 text-sm font-medium text-gray-700 shadow-sm hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2">
+                View Backup Codes
+              </button>
+            </div>
+          <% else %>
            <div class="mt-4 flex gap-3">
              <button type="button"
                      data-action="click->modal#show"
@@ -115,6 +152,7 @@
                View Backup Codes
              </button>
            </div>
+          <% end %>
        <% else %>
          <%= link_to new_totp_path, class: "inline-flex items-center rounded-md border border-transparent bg-blue-600 px-4 py-2 text-sm font-medium text-white shadow-sm hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2" do %>
            Enable 2FA
--- a/app/views/shared/_flash.html.erb
+++ b/app/views/shared/_flash.html.erb
@@ -1,6 +1,8 @@
 <%# Enhanced Flash Messages with Support for Multiple Types and Auto-Dismiss %>
 <% flash.each do |type, message| %>
  <% next if message.blank? %>
+  <%# Skip credential-related flash messages - they're displayed in a special credentials box %>
+  <% next if %w[client_id client_secret public_client].include?(type.to_s) %>

  <%
    # Map flash types to styling
@@ -71,16 +73,3 @@
    </div>
  </div>
 <% end %>
-
-<%# Helper method for border colors %>
-<%
-def border_class_for(type)
-  case type.to_s
-  when 'notice' then 'border-green-200'
-  when 'alert', 'error' then 'border-red-200'
-  when 'warning' then 'border-yellow-200'
-  when 'info' then 'border-blue-200'
-  else 'border-gray-200'
-  end
-end
-%>
--- a/app/views/shared/_form_errors.html.erb
+++ b/app/views/shared/_form_errors.html.erb
@@ -1,5 +1,5 @@
-<%# Usage: <%= render "shared/form_errors", object: @user %> %>
-<%# Usage: <%= render "shared/form_errors", form: form %> %>
+<%# Usage: render "shared/form_errors", object: @user %>
+<%# Usage: render "shared/form_errors", form: form %>

 <% form_object = form.respond_to?(:object) ? form.object : (object || form) %>
 <% if form_object&.errors&.any? %>
--- a/app/views/totp/backup_codes.html.erb
+++ b/app/views/totp/backup_codes.html.erb
@@ -45,8 +45,13 @@
      </div>

      <div class="mt-8">
+        <% if @auto_signin_pending %>
+          <%= button_to "Continue to Sign In", complete_totp_setup_path, method: :post,
+              class: "inline-flex justify-center rounded-md border border-transparent bg-blue-600 py-2 px-4 text-sm font-medium text-white shadow-sm hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2" %>
+        <% else %>
          <%= link_to "Done", profile_path,
              class: "inline-flex justify-center rounded-md border border-transparent bg-blue-600 py-2 px-4 text-sm font-medium text-white shadow-sm hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2" %>
+        <% end %>
      </div>
    </div>
  </div>
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -30,6 +30,14 @@ Rails.application.configure do
  # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
  config.force_ssl = true

+  # Additional security headers (beyond Rails defaults)
+  # Note: Rails already sets X-Content-Type-Options: nosniff by default
+  # Note: Permissions-Policy is configured in config/initializers/permissions_policy.rb
+  config.action_dispatch.default_headers.merge!(
+    'X-Frame-Options' => 'DENY',  # Override default SAMEORIGIN to prevent clickjacking
+    'Referrer-Policy' => 'strict-origin-when-cross-origin'  # Control referrer information
+  )
+
  # Skip http-to-https redirect for the default health check endpoint.
  # config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } }

@@ -49,8 +57,8 @@ Rails.application.configure do
  # Replace the default in-process memory cache store with a durable alternative.
  config.cache_store = :solid_cache_store

-  # Use async processor for background jobs (modify as needed for production)
-  config.active_job.queue_adapter = :async
+  # Use Solid Queue for background jobs
+  config.active_job.queue_adapter = :solid_queue

  # Ignore bad email addresses and do not raise email delivery errors.
  # Set this to true and configure the email server for immediate delivery to raise delivery errors.
@@ -80,14 +88,28 @@ Rails.application.configure do
  # Only use :id for inspections in production.
  config.active_record.attributes_for_inspect = [ :id ]

+  # Helper method to extract domain from CLINCH_HOST (removes protocol if present)
+  def self.extract_domain(host)
+    return host if host.blank?
+    # Remove protocol (http:// or https://) if present
+    host.gsub(/^https?:\/\//, '')
+  end
+
+  # Helper method to ensure URL has https:// protocol
+  def self.ensure_https(url)
+    return url if url.blank?
+    # Add https:// if no protocol is present
+    url.match?(/^https?:\/\//) ? url : "https://#{url}"
+  end
+
  # Enable DNS rebinding protection and other `Host` header attacks.
  # Configure allowed hosts based on deployment scenario
  allowed_hosts = [
-    ENV.fetch('CLINCH_HOST', 'auth.example.com'),  # External domain (auth service itself)
+    extract_domain(ENV.fetch('CLINCH_HOST', 'auth.example.com')),  # External domain (auth service itself)
  ]

  # Use PublicSuffix to extract registrable domain and allow all subdomains
-  host_domain = ENV.fetch('CLINCH_HOST', 'auth.example.com')
+  host_domain = extract_domain(ENV.fetch('CLINCH_HOST', 'auth.example.com'))
  if host_domain.present?
    begin
      # Use PublicSuffix to properly extract the domain
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -53,5 +53,5 @@ Rails.application.configure do

  # Disable Sentry in test environment to avoid interference with tests
  # Sentry can be explicitly enabled for integration testing if needed
-  config.sentry.enabled = false
+  ENV["SENTRY_ENABLED_IN_DEVELOPMENT"] = "false"
 end
--- a/config/initializers/active_storage.rb
+++ b/config/initializers/active_storage.rb
@@ -0,0 +1,14 @@
+# Configure ActiveStorage content type resolution
+Rails.application.config.after_initialize do
+  # Ensure SVG files are served with the correct content type
+  ActiveStorage::Blob.class_eval do
+    def content_type_for_serving
+      # Override content type for SVG files
+      if filename.extension == "svg" && content_type == "application/octet-stream"
+        "image/svg+xml"
+      else
+        content_type
+      end
+    end
+  end
+end
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -39,6 +39,7 @@ Rails.application.configure do
    policy.base_uri :self

    # Form actions: Allow self for all form submissions
+    # Note: OAuth redirects will be handled dynamically in the consent page
    policy.form_action :self

    # Manifest sources: Allow self for PWA manifest
@@ -53,9 +54,12 @@ Rails.application.configure do
    # Additional security headers for WebAuthn
    # Required for WebAuthn to work properly
    policy.require_trusted_types_for :none
+
+    # CSP reporting using report_uri (supported method)
    policy.report_uri  "/api/csp-violation-report"
  end

+  
  # Start with CSP in report-only mode for testing
  # Set to false after verifying everything works in production
  config.content_security_policy_report_only = Rails.env.development?
--- a/config/initializers/csp_local_logger.rb
+++ b/config/initializers/csp_local_logger.rb
@@ -23,6 +23,12 @@ Rails.application.config.after_initialize do
    def self.emit(event)
      csp_data = event[:payload] || {}

+      # Skip logging if there's no meaningful violation data
+      return if csp_data.empty? ||
+                (csp_data[:violated_directive].nil? &&
+                 csp_data[:blocked_uri].nil? &&
+                 csp_data[:document_uri].nil?)
+
      # Build a structured log message
      violated_directive = csp_data[:violated_directive] || "unknown"
      blocked_uri = csp_data[:blocked_uri] || "unknown"
--- a/config/initializers/permissions_policy.rb
+++ b/config/initializers/permissions_policy.rb
@@ -0,0 +1,19 @@
+# Configure the Permissions-Policy header
+# See https://api.rubyonrails.org/classes/ActionDispatch/PermissionsPolicy.html
+
+Rails.application.config.permissions_policy do |f|
+  # Disable sensitive browser features for security
+  f.camera           :none
+  f.gyroscope        :none
+  f.microphone       :none
+  f.payment          :none
+  f.usb              :none
+  f.magnetometer     :none
+
+  # You can enable specific features as needed:
+  # f.fullscreen      :self
+  # f.geolocation     :self
+
+  # You can also allow specific origins:
+  # f.payment         :self, "https://secure.example.com"
+end
--- a/config/initializers/token_hmac.rb
+++ b/config/initializers/token_hmac.rb
@@ -0,0 +1,7 @@
+# Token HMAC key derivation
+# This key is used to compute HMAC-based token prefixes for fast lookup
+# Derived from SECRET_KEY_BASE - no storage needed, deterministic output
+# Optional: Set OIDC_TOKEN_PREFIX_HMAC env var to override with explicit key
+module TokenHmac
+  KEY = ENV['OIDC_TOKEN_PREFIX_HMAC'] || Rails.application.key_generator.generate_key('oidc_token_prefix', 32)
+end
--- a/config/initializers/version.rb
+++ b/config/initializers/version.rb
@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Clinch
+  VERSION = "0.8.0"
+end
--- a/config/initializers/webauthn.rb
+++ b/config/initializers/webauthn.rb
@@ -1,14 +1,31 @@
 # WebAuthn configuration for Clinch Identity Provider
 WebAuthn.configure do |config|
  # Relying Party name (displayed in authenticator prompts)
-  # For development, use http://localhost to match passkey in Passwords app
+  # CLINCH_HOST should include protocol (https://) for WebAuthn
  origin_host = ENV.fetch("CLINCH_HOST", "http://localhost")
  config.allowed_origins = [origin_host]

-  # Relying Party ID (must match origin domain)
-  # Extract domain from origin for RP ID
+  # Relying Party ID (must match origin domain without protocol)
+  # Extract domain from origin for RP ID if CLINCH_RP_ID not set
+  if ENV["CLINCH_RP_ID"].present?
+    config.rp_id = ENV["CLINCH_RP_ID"]
+  else
+    # Extract registrable domain from CLINCH_HOST using PublicSuffix
    origin_uri = URI.parse(origin_host)
-  config.rp_id = ENV.fetch("CLINCH_RP_ID", "localhost")
+    if origin_uri.host
+      begin
+        # Use PublicSuffix to get the registrable domain (e.g., "aapamilne.com" from "auth.aapamilne.com")
+        domain = PublicSuffix.parse(origin_uri.host)
+        config.rp_id = domain.domain || origin_uri.host
+      rescue PublicSuffix::DomainInvalid => e
+        Rails.logger.warn "WebAuthn: Failed to parse domain '#{origin_uri.host}': #{e.message}, using host as fallback"
+        config.rp_id = origin_uri.host
+      end
+    else
+      Rails.logger.error "WebAuthn: Could not extract host from CLINCH_HOST '#{origin_host}'"
+      config.rp_id = "localhost"
+    end
+  end

  # For development, we also allow localhost with common ports and without port
  if Rails.env.development?
--- a/config/recurring.yml
+++ b/config/recurring.yml
@@ -0,0 +1,17 @@
+# Solid Queue Recurring Jobs Configuration
+# This file defines scheduled/cron-like jobs that run periodically
+
+production:
+  oidc_token_cleanup:
+    class: OidcTokenCleanupJob
+    schedule: "0 3 * * *"  # Run daily at 3:00 AM
+    queue: default
+
+development:
+  oidc_token_cleanup:
+    class: OidcTokenCleanupJob
+    schedule: "0 3 * * *"  # Run daily at 3:00 AM
+    queue: default
+
+test:
+  # No recurring jobs in test environment
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -29,6 +29,7 @@ Rails.application.routes.draw do
  get "/oauth/authorize", to: "oidc#authorize"
  post "/oauth/authorize/consent", to: "oidc#consent", as: :oauth_consent
  post "/oauth/token", to: "oidc#token"
+  post "/oauth/revoke", to: "oidc#revoke"
  get "/oauth/userinfo", to: "oidc#userinfo"
  get "/logout", to: "oidc#logout"

@@ -48,6 +49,7 @@ Rails.application.routes.draw do
  end
  resource :active_sessions, only: [:show] do
    member do
+      delete :logout_from_app
      delete :revoke_consent
      delete :revoke_all_consents
    end
@@ -66,6 +68,7 @@ Rails.application.routes.draw do
  post '/totp/verify_password', to: 'totp#verify_password', as: :verify_password_totp
  get '/totp/regenerate_backup_codes', to: 'totp#regenerate_backup_codes', as: :regenerate_backup_codes_totp
  post '/totp/regenerate_backup_codes', to: 'totp#create_new_backup_codes', as: :create_new_backup_codes_totp
+  post '/totp/complete_setup', to: 'totp#complete_setup', as: :complete_totp_setup

  # WebAuthn (Passkeys) routes
  get '/webauthn/new', to: 'webauthn#new', as: :new_webauthn
@@ -80,6 +83,8 @@ Rails.application.routes.draw do
    resources :users do
      member do
        post :resend_invitation
+        post :update_application_claims
+        delete :delete_application_claims
      end
    end
    resources :applications do
--- a/config/storage.yml
+++ b/config/storage.yml
@@ -4,7 +4,7 @@ test:

 local:
  service: Disk
-  root: <%= Rails.root.join("storage") %>
+  root: <%= Rails.root.join("storage/uploads") %>

 # Use bin/rails credentials:edit to set the AWS secrets (as aws:access_key_id|secret_access_key)
 # amazon:
--- a/db/migrate/20251108090123_add_pkce_support_to_oidc_authorization_codes.rb
+++ b/db/migrate/20251108090123_add_pkce_support_to_oidc_authorization_codes.rb
@@ -0,0 +1,9 @@
+class AddPkceSupportToOidcAuthorizationCodes < ActiveRecord::Migration[8.1]
+  def change
+    add_column :oidc_authorization_codes, :code_challenge, :string
+    add_column :oidc_authorization_codes, :code_challenge_method, :string
+
+    # Add index for code_challenge to improve query performance
+    add_index :oidc_authorization_codes, :code_challenge
+  end
+end
--- a/db/migrate/20251109011443_fix_empty_domain_patterns.rb
+++ b/db/migrate/20251109011443_fix_empty_domain_patterns.rb
@@ -0,0 +1,17 @@
+class FixEmptyDomainPatterns < ActiveRecord::Migration[8.1]
+  def up
+    # Convert empty string domain_patterns to NULL
+    # This fixes a unique constraint issue where multiple OIDC apps
+    # had empty string domain_patterns, causing uniqueness violations
+    execute <<-SQL
+      UPDATE applications
+      SET domain_pattern = NULL
+      WHERE domain_pattern = ''
+    SQL
+  end
+
+  def down
+    # No need to reverse this - empty strings and NULL are functionally equivalent
+    # for OIDC applications where domain_pattern is not used
+  end
+end
--- a/db/migrate/20251112114852_create_oidc_refresh_tokens.rb
+++ b/db/migrate/20251112114852_create_oidc_refresh_tokens.rb
@@ -0,0 +1,22 @@
+class CreateOidcRefreshTokens < ActiveRecord::Migration[8.1]
+  def change
+    create_table :oidc_refresh_tokens do |t|
+      t.string :token_digest, null: false  # BCrypt hashed token
+      t.references :application, null: false, foreign_key: true
+      t.references :user, null: false, foreign_key: true
+      t.references :oidc_access_token, null: false, foreign_key: true
+      t.string :scope
+      t.datetime :expires_at, null: false
+      t.datetime :revoked_at
+      t.integer :token_family_id  # For token rotation detection
+
+      t.timestamps
+    end
+
+    add_index :oidc_refresh_tokens, :token_digest, unique: true
+    add_index :oidc_refresh_tokens, :expires_at
+    add_index :oidc_refresh_tokens, :revoked_at
+    add_index :oidc_refresh_tokens, :token_family_id
+    add_index :oidc_refresh_tokens, [ :application_id, :user_id ]
+  end
+end
--- a/db/migrate/20251112114945_add_token_digest_to_oidc_access_tokens.rb
+++ b/db/migrate/20251112114945_add_token_digest_to_oidc_access_tokens.rb
@@ -0,0 +1,9 @@
+class AddTokenDigestToOidcAccessTokens < ActiveRecord::Migration[8.1]
+  def change
+    add_column :oidc_access_tokens, :token_digest, :string
+    add_column :oidc_access_tokens, :revoked_at, :datetime
+
+    add_index :oidc_access_tokens, :token_digest, unique: true
+    add_index :oidc_access_tokens, :revoked_at
+  end
+end
--- a/db/migrate/20251112115845_add_token_expiry_to_applications.rb
+++ b/db/migrate/20251112115845_add_token_expiry_to_applications.rb
@@ -0,0 +1,7 @@
+class AddTokenExpiryToApplications < ActiveRecord::Migration[8.1]
+  def change
+    add_column :applications, :access_token_ttl, :integer, default: 3600  # 1 hour in seconds
+    add_column :applications, :refresh_token_ttl, :integer, default: 2592000  # 30 days in seconds
+    add_column :applications, :id_token_ttl, :integer, default: 3600  # 1 hour in seconds
+  end
+end
--- a/db/migrate/20251112120314_make_oidc_access_token_token_nullable.rb
+++ b/db/migrate/20251112120314_make_oidc_access_token_token_nullable.rb
@@ -0,0 +1,5 @@
+class MakeOidcAccessTokenTokenNullable < ActiveRecord::Migration[8.1]
+  def change
+    change_column_null :oidc_access_tokens, :token, true
+  end
+end
--- a/db/migrate/20251122235519_add_sid_to_oidc_user_consent.rb
+++ b/db/migrate/20251122235519_add_sid_to_oidc_user_consent.rb
@@ -0,0 +1,15 @@
+class AddSidToOidcUserConsent < ActiveRecord::Migration[8.1]
+  def change
+    add_column :oidc_user_consents, :sid, :string
+    add_index :oidc_user_consents, :sid
+
+    # Generate UUIDs for existing consent records
+    reversible do |dir|
+      dir.up do
+        OidcUserConsent.where(sid: nil).find_each do |consent|
+          consent.update_column(:sid, SecureRandom.uuid)
+        end
+      end
+    end
+  end
+end
--- a/db/migrate/20251123052026_create_application_user_claims.rb
+++ b/db/migrate/20251123052026_create_application_user_claims.rb
@@ -0,0 +1,13 @@
+class CreateApplicationUserClaims < ActiveRecord::Migration[8.1]
+  def change
+    create_table :application_user_claims do |t|
+      t.references :application, null: false, foreign_key: { on_delete: :cascade }
+      t.references :user, null: false, foreign_key: { on_delete: :cascade }
+      t.json :custom_claims, default: {}, null: false
+
+      t.timestamps
+    end
+
+    add_index :application_user_claims, [:application_id, :user_id], unique: true, name: 'index_app_user_claims_unique'
+  end
+end
--- a/db/migrate/20251125012446_add_username_to_users.rb
+++ b/db/migrate/20251125012446_add_username_to_users.rb
@@ -0,0 +1,6 @@
+class AddUsernameToUsers < ActiveRecord::Migration[8.1]
+  def change
+    add_column :users, :username, :string
+    add_index :users, :username, unique: true
+  end
+end
--- a/db/migrate/20251125063248_create_active_storage_tables.active_storage.rb
+++ b/db/migrate/20251125063248_create_active_storage_tables.active_storage.rb
@@ -0,0 +1,57 @@
+# This migration comes from active_storage (originally 20170806125915)
+class CreateActiveStorageTables < ActiveRecord::Migration[7.0]
+  def change
+    # Use Active Record's configured type for primary and foreign keys
+    primary_key_type, foreign_key_type = primary_and_foreign_key_types
+
+    create_table :active_storage_blobs, id: primary_key_type do |t|
+      t.string   :key,          null: false
+      t.string   :filename,     null: false
+      t.string   :content_type
+      t.text     :metadata
+      t.string   :service_name, null: false
+      t.bigint   :byte_size,    null: false
+      t.string   :checksum
+
+      if connection.supports_datetime_with_precision?
+        t.datetime :created_at, precision: 6, null: false
+      else
+        t.datetime :created_at, null: false
+      end
+
+      t.index [ :key ], unique: true
+    end
+
+    create_table :active_storage_attachments, id: primary_key_type do |t|
+      t.string     :name,     null: false
+      t.references :record,   null: false, polymorphic: true, index: false, type: foreign_key_type
+      t.references :blob,     null: false, type: foreign_key_type
+
+      if connection.supports_datetime_with_precision?
+        t.datetime :created_at, precision: 6, null: false
+      else
+        t.datetime :created_at, null: false
+      end
+
+      t.index [ :record_type, :record_id, :name, :blob_id ], name: :index_active_storage_attachments_uniqueness, unique: true
+      t.foreign_key :active_storage_blobs, column: :blob_id
+    end
+
+    create_table :active_storage_variant_records, id: primary_key_type do |t|
+      t.belongs_to :blob, null: false, index: false, type: foreign_key_type
+      t.string :variation_digest, null: false
+
+      t.index [ :blob_id, :variation_digest ], name: :index_active_storage_variant_records_uniqueness, unique: true
+      t.foreign_key :active_storage_blobs, column: :blob_id
+    end
+  end
+
+  private
+    def primary_and_foreign_key_types
+      config = Rails.configuration.generators
+      setting = config.options[config.orm][:primary_key_type]
+      primary_key_type = setting || :primary_key
+      foreign_key_type = setting || :bigint
+      [ primary_key_type, foreign_key_type ]
+    end
+end
--- a/db/migrate/20251125081147_add_backchannel_logout_uri_to_applications.rb
+++ b/db/migrate/20251125081147_add_backchannel_logout_uri_to_applications.rb
@@ -0,0 +1,5 @@
+class AddBackchannelLogoutUriToApplications < ActiveRecord::Migration[8.1]
+  def change
+    add_column :applications, :backchannel_logout_uri, :string
+  end
+end
--- a/db/migrate/20251229220739_add_token_prefix_to_tokens.rb
+++ b/db/migrate/20251229220739_add_token_prefix_to_tokens.rb
@@ -0,0 +1,42 @@
+class AddTokenPrefixToTokens < ActiveRecord::Migration[8.1]
+  def up
+    add_column :oidc_access_tokens, :token_prefix, :string, limit: 8
+    add_column :oidc_refresh_tokens, :token_prefix, :string, limit: 8
+
+    # Backfill existing tokens with prefix and digest
+    say_with_time "Backfilling token prefixes and digests..." do
+      [OidcAccessToken, OidcRefreshToken].each do |klass|
+        klass.reset_column_information  # Ensure Rails knows about new column
+
+        klass.where(token_prefix: nil).find_each do |token|
+          next unless token.token.present?
+
+          updates = {}
+
+          # Compute HMAC prefix
+          prefix = klass.compute_token_prefix(token.token)
+          updates[:token_prefix] = prefix if prefix.present?
+
+          # Backfill digest if missing
+          if token.token_digest.nil?
+            updates[:token_digest] = BCrypt::Password.create(token.token)
+          end
+
+          token.update_columns(updates) if updates.any?
+        end
+
+        say "  #{klass.name}: #{klass.where.not(token_prefix: nil).count} tokens backfilled"
+      end
+    end
+
+    add_index :oidc_access_tokens, :token_prefix
+    add_index :oidc_refresh_tokens, :token_prefix
+  end
+
+  def down
+    remove_index :oidc_access_tokens, :token_prefix
+    remove_index :oidc_refresh_tokens, :token_prefix
+    remove_column :oidc_access_tokens, :token_prefix
+    remove_column :oidc_refresh_tokens, :token_prefix
+  end
+end
--- a/db/migrate/20251230005248_remove_plaintext_token_from_oidc_access_tokens.rb
+++ b/db/migrate/20251230005248_remove_plaintext_token_from_oidc_access_tokens.rb
@@ -0,0 +1,10 @@
+class RemovePlaintextTokenFromOidcAccessTokens < ActiveRecord::Migration[8.1]
+  def change
+    # Remove the unique index first
+    remove_index :oidc_access_tokens, :token, if_exists: true
+
+    # Remove the plaintext token column - no longer needed
+    # Tokens are now stored as BCrypt-hashed token_digest with HMAC token_prefix
+    remove_column :oidc_access_tokens, :token, :string
+  end
+end
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,35 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema[8.1].define(version: 2025_11_04_064114) do
+ActiveRecord::Schema[8.1].define(version: 2025_12_30_073656) do
+  create_table "active_storage_attachments", force: :cascade do |t|
+    t.bigint "blob_id", null: false
+    t.datetime "created_at", null: false
+    t.string "name", null: false
+    t.bigint "record_id", null: false
+    t.string "record_type", null: false
+    t.index ["blob_id"], name: "index_active_storage_attachments_on_blob_id"
+    t.index ["record_type", "record_id", "name", "blob_id"], name: "index_active_storage_attachments_uniqueness", unique: true
+  end
+
+  create_table "active_storage_blobs", force: :cascade do |t|
+    t.bigint "byte_size", null: false
+    t.string "checksum"
+    t.string "content_type"
+    t.datetime "created_at", null: false
+    t.string "filename", null: false
+    t.string "key", null: false
+    t.text "metadata"
+    t.string "service_name", null: false
+    t.index ["key"], name: "index_active_storage_blobs_on_key", unique: true
+  end
+
+  create_table "active_storage_variant_records", force: :cascade do |t|
+    t.bigint "blob_id", null: false
+    t.string "variation_digest", null: false
+    t.index ["blob_id", "variation_digest"], name: "index_active_storage_variant_records_uniqueness", unique: true
+  end
+
  create_table "application_groups", force: :cascade do |t|
    t.integer "application_id", null: false
    t.datetime "created_at", null: false
@@ -21,19 +49,35 @@ ActiveRecord::Schema[8.1].define(version: 2025_11_04_064114) do
    t.index ["group_id"], name: "index_application_groups_on_group_id"
  end

+  create_table "application_user_claims", force: :cascade do |t|
+    t.integer "application_id", null: false
+    t.datetime "created_at", null: false
+    t.json "custom_claims", default: {}, null: false
+    t.datetime "updated_at", null: false
+    t.integer "user_id", null: false
+    t.index ["application_id", "user_id"], name: "index_app_user_claims_unique", unique: true
+    t.index ["application_id"], name: "index_application_user_claims_on_application_id"
+    t.index ["user_id"], name: "index_application_user_claims_on_user_id"
+  end
+
  create_table "applications", force: :cascade do |t|
+    t.integer "access_token_ttl", default: 3600
    t.boolean "active", default: true, null: false
    t.string "app_type", null: false
+    t.string "backchannel_logout_uri"
    t.string "client_id"
    t.string "client_secret_digest"
    t.datetime "created_at", null: false
    t.text "description"
    t.string "domain_pattern"
    t.json "headers_config", default: {}, null: false
+    t.integer "id_token_ttl", default: 3600
    t.string "landing_url"
    t.text "metadata"
    t.string "name", null: false
    t.text "redirect_uris"
+    t.integer "refresh_token_ttl", default: 2592000
+    t.boolean "require_pkce", default: true, null: false
    t.string "slug", null: false
    t.datetime "updated_at", null: false
    t.index ["active"], name: "index_applications_on_active"
@@ -55,20 +99,26 @@ ActiveRecord::Schema[8.1].define(version: 2025_11_04_064114) do
    t.integer "application_id", null: false
    t.datetime "created_at", null: false
    t.datetime "expires_at", null: false
+    t.datetime "revoked_at"
    t.string "scope"
-    t.string "token", null: false
+    t.string "token_digest"
+    t.string "token_prefix", limit: 8
    t.datetime "updated_at", null: false
    t.integer "user_id", null: false
    t.index ["application_id", "user_id"], name: "index_oidc_access_tokens_on_application_id_and_user_id"
    t.index ["application_id"], name: "index_oidc_access_tokens_on_application_id"
    t.index ["expires_at"], name: "index_oidc_access_tokens_on_expires_at"
-    t.index ["token"], name: "index_oidc_access_tokens_on_token", unique: true
+    t.index ["revoked_at"], name: "index_oidc_access_tokens_on_revoked_at"
+    t.index ["token_digest"], name: "index_oidc_access_tokens_on_token_digest", unique: true
+    t.index ["token_prefix"], name: "index_oidc_access_tokens_on_token_prefix"
    t.index ["user_id"], name: "index_oidc_access_tokens_on_user_id"
  end

  create_table "oidc_authorization_codes", force: :cascade do |t|
    t.integer "application_id", null: false
    t.string "code", null: false
+    t.string "code_challenge"
+    t.string "code_challenge_method"
    t.datetime "created_at", null: false
    t.datetime "expires_at", null: false
    t.string "nonce"
@@ -80,19 +130,45 @@ ActiveRecord::Schema[8.1].define(version: 2025_11_04_064114) do
    t.index ["application_id", "user_id"], name: "index_oidc_authorization_codes_on_application_id_and_user_id"
    t.index ["application_id"], name: "index_oidc_authorization_codes_on_application_id"
    t.index ["code"], name: "index_oidc_authorization_codes_on_code", unique: true
+    t.index ["code_challenge"], name: "index_oidc_authorization_codes_on_code_challenge"
    t.index ["expires_at"], name: "index_oidc_authorization_codes_on_expires_at"
    t.index ["user_id"], name: "index_oidc_authorization_codes_on_user_id"
  end

+  create_table "oidc_refresh_tokens", force: :cascade do |t|
+    t.integer "application_id", null: false
+    t.datetime "created_at", null: false
+    t.datetime "expires_at", null: false
+    t.integer "oidc_access_token_id", null: false
+    t.datetime "revoked_at"
+    t.string "scope"
+    t.string "token_digest", null: false
+    t.integer "token_family_id"
+    t.string "token_prefix", limit: 8
+    t.datetime "updated_at", null: false
+    t.integer "user_id", null: false
+    t.index ["application_id", "user_id"], name: "index_oidc_refresh_tokens_on_application_id_and_user_id"
+    t.index ["application_id"], name: "index_oidc_refresh_tokens_on_application_id"
+    t.index ["expires_at"], name: "index_oidc_refresh_tokens_on_expires_at"
+    t.index ["oidc_access_token_id"], name: "index_oidc_refresh_tokens_on_oidc_access_token_id"
+    t.index ["revoked_at"], name: "index_oidc_refresh_tokens_on_revoked_at"
+    t.index ["token_digest"], name: "index_oidc_refresh_tokens_on_token_digest", unique: true
+    t.index ["token_family_id"], name: "index_oidc_refresh_tokens_on_token_family_id"
+    t.index ["token_prefix"], name: "index_oidc_refresh_tokens_on_token_prefix"
+    t.index ["user_id"], name: "index_oidc_refresh_tokens_on_user_id"
+  end
+
  create_table "oidc_user_consents", force: :cascade do |t|
    t.integer "application_id", null: false
    t.datetime "created_at", null: false
    t.datetime "granted_at", null: false
    t.text "scopes_granted", null: false
+    t.string "sid"
    t.datetime "updated_at", null: false
    t.integer "user_id", null: false
    t.index ["application_id"], name: "index_oidc_user_consents_on_application_id"
    t.index ["granted_at"], name: "index_oidc_user_consents_on_granted_at"
+    t.index ["sid"], name: "index_oidc_user_consents_on_sid"
    t.index ["user_id", "application_id"], name: "index_oidc_user_consents_on_user_id_and_application_id", unique: true
    t.index ["user_id"], name: "index_oidc_user_consents_on_user_id"
  end
@@ -136,10 +212,12 @@ ActiveRecord::Schema[8.1].define(version: 2025_11_04_064114) do
    t.boolean "totp_required", default: false, null: false
    t.string "totp_secret"
    t.datetime "updated_at", null: false
+    t.string "username"
    t.string "webauthn_id"
    t.boolean "webauthn_required", default: false, null: false
    t.index ["email_address"], name: "index_users_on_email_address", unique: true
    t.index ["status"], name: "index_users_on_status"
+    t.index ["username"], name: "index_users_on_username", unique: true
    t.index ["webauthn_id"], name: "index_users_on_webauthn_id", unique: true
  end

@@ -165,12 +243,19 @@ ActiveRecord::Schema[8.1].define(version: 2025_11_04_064114) do
    t.index ["user_id"], name: "index_webauthn_credentials_on_user_id"
  end

+  add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id"
+  add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id"
  add_foreign_key "application_groups", "applications"
  add_foreign_key "application_groups", "groups"
+  add_foreign_key "application_user_claims", "applications", on_delete: :cascade
+  add_foreign_key "application_user_claims", "users", on_delete: :cascade
  add_foreign_key "oidc_access_tokens", "applications"
  add_foreign_key "oidc_access_tokens", "users"
  add_foreign_key "oidc_authorization_codes", "applications"
  add_foreign_key "oidc_authorization_codes", "users"
+  add_foreign_key "oidc_refresh_tokens", "applications"
+  add_foreign_key "oidc_refresh_tokens", "oidc_access_tokens"
+  add_foreign_key "oidc_refresh_tokens", "users"
  add_foreign_key "oidc_user_consents", "applications"
  add_foreign_key "oidc_user_consents", "users"
  add_foreign_key "sessions", "users"
--- a/docs/backchannel-logout.md
+++ b/docs/backchannel-logout.md
@@ -0,0 +1,316 @@
+# OpenID Connect Backchannel Logout
+
+## Overview
+
+Backchannel logout is an OpenID Connect feature that enables Clinch to notify applications when a user logs out, ensuring sessions are terminated across all connected applications immediately.
+
+## How It Works
+
+When a user logs out from Clinch (or any connected application), Clinch sends server-to-server HTTP POST requests to all applications that have configured a backchannel logout endpoint. This happens automatically in the background.
+
+### Logout Triggers
+
+Backchannel logout notifications are sent when:
+
+1. **User clicks "Sign Out" in Clinch** - All connected OIDC applications are notified, then the Clinch session is terminated
+2. **User logs out via OIDC `/logout` endpoint** (RP-Initiated Logout) - All connected applications are notified, then the Clinch session is terminated
+3. **User clicks "Logout" on an app (Dashboard)** - Backchannel logout is sent to that app, all access/refresh tokens are revoked, but OAuth consent is preserved (user can sign back in without re-authorizing)
+4. **User clicks "Revoke Access" for a specific app (Active Sessions page)** - Backchannel logout is sent to that app to terminate its session, all access/refresh tokens are revoked, then the OAuth consent is permanently destroyed (user must re-authorize the app to use it again)
+5. **User clicks "Revoke All App Access"** - All connected applications receive backchannel logout notifications, all tokens are revoked, then all OAuth consents are permanently destroyed
+
+### The Logout Flow
+
+```
+User logs out → Clinch finds all connected apps
+                ↓
+        For each app with backchannel_logout_uri:
+                ↓
+        Generate signed JWT logout token
+                ↓
+        HTTP POST to app's logout endpoint
+                ↓
+        App validates JWT and terminates session
+                ↓
+        Clinch revokes access and refresh tokens
+```
+
+### Logout vs Revoke Access
+
+Clinch provides two distinct actions for managing application access:
+
+| Action | Location | What Happens | When to Use |
+|--------|----------|--------------|-------------|
+| **Logout** | Dashboard | • Sends backchannel logout to app<br>• Revokes all access tokens<br>• Revokes all refresh tokens<br>• **Keeps OAuth consent intact** | You want to end your session with an app but still trust it. Next login will skip the authorization screen. |
+| **Revoke Access** | Active Sessions page | • Sends backchannel logout to app<br>• Revokes all access tokens<br>• Revokes all refresh tokens<br>• **Destroys OAuth consent** | You want to completely de-authorize an app. Next login will require you to re-authorize the app. |
+
+**Key Difference**: "Logout" preserves the authorization relationship while terminating the active session. "Revoke Access" completely removes the app's authorization to access your account.
+
+**Example Use Cases**:
+- **Logout**: "I left my Jellyfin session open at a friend's house. I want to kill that session but I still use Jellyfin."
+- **Revoke Access**: "I no longer trust this app and want to remove its authorization completely."
+
+**Technical Details**:
+- Both actions revoke access tokens (opaque, database-backed, validated on each use)
+- Both actions revoke refresh tokens (prevents obtaining new access tokens)
+- ID tokens remain valid until expiry (stateless JWTs), but apps should honor backchannel logout
+- Backchannel logout ensures the app clears its local session immediately
+
+## Configuring Applications
+
+### In Clinch Admin UI
+
+1. Navigate to **Admin → Applications**
+2. Edit or create an OIDC application
+3. In the "Backchannel Logout URI" field, enter the application's logout endpoint
+   - Example: `https://kavita.local/oidc/backchannel-logout`
+   - Must be HTTPS in production
+   - Leave blank if the application doesn't support backchannel logout
+
+### Checking Support
+
+The OIDC discovery endpoint advertises backchannel logout support:
+
+```bash
+curl https://clinch.local/.well-known/openid-configuration | jq
+```
+
+Look for:
+```json
+{
+  "backchannel_logout_supported": true,
+  "backchannel_logout_session_supported": true
+}
+```
+
+## Implementing a Backchannel Logout Endpoint (for RPs)
+
+If you're developing an application that integrates with Clinch, here's how to implement backchannel logout support:
+
+### 1. Create the Endpoint
+
+The endpoint must:
+- Accept HTTP POST requests
+- Parse the `logout_token` parameter from the form body
+- Validate the JWT signature
+- Terminate the user's session
+- Return 200 OK quickly (within 5 seconds)
+
+### 2. Example Implementation (Ruby/Rails)
+
+```ruby
+# config/routes.rb
+post '/oidc/backchannel-logout', to: 'oidc_backchannel_logout#logout'
+
+# app/controllers/oidc_backchannel_logout_controller.rb
+class OidcBackchannelLogoutController < ApplicationController
+  skip_before_action :verify_authenticity_token  # Server-to-server call
+  skip_before_action :authenticate_user!         # No user session yet
+
+  def logout
+    logout_token = params[:logout_token]
+
+    unless logout_token.present?
+      head :bad_request
+      return
+    end
+
+    begin
+      # Decode and verify the JWT
+      # Get Clinch's public key from JWKS endpoint
+      jwks = fetch_clinch_jwks
+      decoded = JWT.decode(
+        logout_token,
+        nil,  # Will be verified using JWKS
+        true,
+        {
+          algorithms: ['RS256'],
+          jwks: jwks,
+          verify_aud: true,
+          aud: YOUR_CLIENT_ID,
+          verify_iss: true,
+          iss: 'https://clinch.local'  # Your Clinch URL
+        }
+      )
+
+      claims = decoded.first
+
+      # Validate required claims
+      unless claims['events']&.key?('http://schemas.openid.net/event/backchannel-logout')
+        head :bad_request
+        return
+      end
+
+      # Get session ID from the token
+      sid = claims['sid']
+      sub = claims['sub']
+
+      # Terminate sessions
+      if sid.present?
+        # Terminate specific session by SID (recommended)
+        Session.where(oidc_sid: sid).destroy_all
+      elsif sub.present?
+        # Terminate all sessions for this user
+        user = User.find_by(oidc_sub: sub)
+        user&.sessions&.destroy_all
+      end
+
+      Rails.logger.info "Backchannel logout: Terminated session for sid=#{sid}, sub=#{sub}"
+      head :ok
+
+    rescue JWT::DecodeError => e
+      Rails.logger.error "Backchannel logout: Invalid JWT - #{e.message}"
+      head :bad_request
+    rescue => e
+      Rails.logger.error "Backchannel logout: Error - #{e.class}: #{e.message}"
+      head :internal_server_error
+    end
+  end
+
+  private
+
+  def fetch_clinch_jwks
+    # Cache this in production!
+    response = HTTParty.get('https://clinch.local/.well-known/jwks.json')
+    JSON.parse(response.body, symbolize_names: true)
+  end
+end
+```
+
+### 3. Required JWT Claims Validation
+
+The logout token will contain:
+
+| Claim | Description | Required |
+|-------|-------------|----------|
+| `iss` | Issuer (Clinch URL) | Yes |
+| `aud` | Your application's client_id | Yes |
+| `iat` | Issued at timestamp | Yes |
+| `jti` | Unique token ID | Yes |
+| `sub` | Pairwise subject identifier (user's SID) | Yes |
+| `sid` | Session ID (same as sub) | Yes |
+| `events` | Must contain `http://schemas.openid.net/event/backchannel-logout` | Yes |
+| `nonce` | Must NOT be present (spec requirement) | No |
+
+### 4. Session Tracking Requirements
+
+To support backchannel logout, your application must:
+
+1. **Store the `sid` claim from ID tokens**:
+   ```ruby
+   # When user logs in via OIDC
+   id_token = decode_id_token(params[:id_token])
+   session[:oidc_sid] = id_token['sid']  # Store this!
+   ```
+
+2. **Associate sessions with SID**:
+   ```ruby
+   # Create session with SID tracking
+   Session.create!(
+     user: current_user,
+     oidc_sid: id_token['sid'],
+     ...
+   )
+   ```
+
+3. **Terminate sessions by SID**:
+   ```ruby
+   # When backchannel logout is received
+   Session.where(oidc_sid: sid).destroy_all
+   ```
+
+### 5. Testing Your Endpoint
+
+Test with curl:
+
+```bash
+# Get a valid logout token (you'll need to capture this from Clinch logs)
+LOGOUT_TOKEN="eyJhbGc..."
+
+curl -X POST https://your-app.local/oidc/backchannel-logout \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "logout_token=$LOGOUT_TOKEN"
+```
+
+Expected response: `200 OK` (empty body)
+
+## Monitoring and Troubleshooting
+
+### Checking Logs
+
+Clinch logs all backchannel logout attempts:
+
+```bash
+# In development
+tail -f log/development.log | grep BackchannelLogout
+
+# Example log output:
+# BackchannelLogout: Successfully sent logout notification to Kavita (https://kavita.local/oidc/backchannel-logout)
+# BackchannelLogout: Application Jellyfin doesn't support backchannel logout
+# BackchannelLogout: Timeout sending logout to HomeAssistant (https://ha.local/logout): Connection timeout
+```
+
+### Common Issues
+
+**1. HTTP Timeout**
+- Symptom: `Timeout sending logout to...` in logs
+- Solution: Ensure the RP's backchannel logout endpoint responds within 5 seconds
+- Note: Clinch will retry 3 times with exponential backoff
+
+**2. HTTP Errors (Non-200 Status)**
+- Symptom: `Application X returned HTTP 400/500...` in logs
+- Solution: Check the RP's logs for JWT validation errors
+- Common causes:
+  - Wrong JWKS (public key mismatch)
+  - Incorrect `aud` (client_id) validation
+  - Missing required claims validation
+
+**3. Network Unreachable**
+- Symptom: `Failed to send logout to...` with connection errors
+- Solution: Ensure the RP's logout endpoint is accessible from Clinch server
+- Check: Firewalls, DNS, SSL certificates
+
+**4. Sessions Not Terminating**
+- Symptom: User still logged into RP after logging out of Clinch
+- Solution: Verify the RP is storing and checking `sid` correctly
+- Debug: Add logging to the RP's backchannel logout handler
+
+### Verification Checklist
+
+For RPs (Application Developers):
+- [ ] Endpoint accepts POST requests
+- [ ] Endpoint validates JWT signature using Clinch's JWKS
+- [ ] Endpoint validates all required claims
+- [ ] Endpoint terminates sessions by SID
+- [ ] Endpoint returns 200 OK quickly (< 5 seconds)
+- [ ] Sessions store the `sid` claim from ID tokens
+- [ ] Backchannel logout URI is configured in Clinch admin
+
+For Administrators:
+- [ ] Application has `backchannel_logout_uri` configured
+- [ ] URI uses HTTPS (in production)
+- [ ] URI is reachable from Clinch server
+- [ ] Check logs for successful logout notifications
+
+## Security Considerations
+
+1. **JWT Signature Verification**: Always verify the logout token signature using Clinch's public key
+2. **Audience Validation**: Ensure the `aud` claim matches your client_id
+3. **Issuer Validation**: Ensure the `iss` claim matches your Clinch URL
+4. **No Authentication Required**: The endpoint should not require user authentication (it's server-to-server)
+5. **HTTPS Only**: Always use HTTPS in production (Clinch enforces this)
+6. **Fire-and-Forget**: RPs should log failures but not block on errors
+
+## Comparison with Other Logout Methods
+
+| Method | Communication | When Sessions Terminate | Reliability |
+|--------|--------------|------------------------|-------------|
+| **Backchannel Logout** | Server-to-server POST | Immediately | High (retries on failure) |
+| **Front-Channel Logout** | Browser iframes | When browser loads iframes | Low (blocked by privacy settings) |
+| **RP-Initiated Logout** | User redirects to Clinch | Only affects Clinch session | N/A (just triggers other methods) |
+| **Token Expiry** | None | When access token expires | Guaranteed but delayed |
+
+## References
+
+- [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html)
+- [RFC 7009: OAuth 2.0 Token Revocation](https://tools.ietf.org/html/rfc7009)
+- [Clinch OIDC Discovery](/.well-known/openid-configuration)
--- a/test/controllers/api/forward_auth_controller_test.rb
+++ b/test/controllers/api/forward_auth_controller_test.rb
@@ -5,10 +5,10 @@ module Api
    setup do
      @user = users(:bob)
      @admin_user = users(:alice)
-      @inactive_user = users(:bob)  # We'll create an inactive user in setup if needed
+      @inactive_user = User.create!(email_address: "inactive@example.com", password: "password", status: :disabled)
      @group = groups(:admin_group)
-      @rule = ForwardAuthRule.create!(domain_pattern: "test.example.com", active: true)
-      @inactive_rule = ForwardAuthRule.create!(domain_pattern: "inactive.example.com", active: false)
+      @rule = Application.create!(name: "Test App", slug: "test-app", app_type: "forward_auth", domain_pattern: "test.example.com", active: true)
+      @inactive_rule = Application.create!(name: "Inactive App", slug: "inactive-app", app_type: "forward_auth", domain_pattern: "inactive.example.com", active: false)
    end

    # Authentication Tests
@@ -17,31 +17,7 @@ module Api

      assert_response 302
      assert_match %r{/signin}, response.location
-      assert_equal "No session cookie", response.headers["X-Auth-Reason"]
-    end
-
-    test "should redirect when session cookie is invalid" do
-      get "/api/verify", headers: {
-        "X-Forwarded-Host" => "test.example.com",
-        "Cookie" => "_clinch_session_id=invalid_session_id"
-      }
-
-      assert_response 302
-      assert_match %r{/signin}, response.location
-      assert_equal "Invalid session", response.headers["X-Auth-Reason"]
-    end
-
-    test "should redirect when session is expired" do
-      expired_session = @user.sessions.create!(created_at: 1.year.ago)
-
-      get "/api/verify", headers: {
-        "X-Forwarded-Host" => "test.example.com",
-        "Cookie" => "_clinch_session_id=#{expired_session.id}"
-      }
-
-      assert_response 302
-      assert_match %r{/signin}, response.location
-      assert_equal "Session expired", response.headers["X-Auth-Reason"]
+      assert_equal "No session cookie", response.headers["x-auth-reason"]
    end

    test "should redirect when user is inactive" do
@@ -50,7 +26,7 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }

      assert_response 302
-      assert_equal "User account is not active", response.headers["X-Auth-Reason"]
+      assert_equal "User account is not active", response.headers["x-auth-reason"]
    end

    test "should return 200 when user is authenticated" do
@@ -70,14 +46,13 @@ module Api
      assert_response 200
    end

-    test "should return 200 with default headers when no rule matches" do
+    test "should return 403 when no rule matches (fail-closed security)" do
      sign_in_as(@user)

      get "/api/verify", headers: { "X-Forwarded-Host" => "unknown.example.com" }

-      assert_response 200
-      assert_equal @user.email_address, response.headers["X-Remote-User"]
-      assert_equal @user.email_address, response.headers["X-Remote-Email"]
+      assert_response 403
+      assert_equal "No authentication rule configured for this domain", response.headers["x-auth-reason"]
    end

    test "should return 403 when rule exists but is inactive" do
@@ -86,7 +61,7 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "inactive.example.com" }

      assert_response 403
-      assert_equal "No authentication rule configured for this domain", response.headers["X-Auth-Reason"]
+      assert_equal "No authentication rule configured for this domain", response.headers["x-auth-reason"]
    end

    test "should return 403 when rule exists but user not in allowed groups" do
@@ -96,7 +71,7 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }

      assert_response 403
-      assert_match %r{permission to access this domain}, response.headers["X-Auth-Reason"]
+      assert_match %r{permission to access this domain}, response.headers["x-auth-reason"]
    end

    test "should return 200 when user is in allowed groups" do
@@ -111,7 +86,7 @@ module Api

    # Domain Pattern Tests
    test "should match wildcard domains correctly" do
-      wildcard_rule = ForwardAuthRule.create!(domain_pattern: "*.example.com", active: true)
+      wildcard_rule = Application.create!(name: "Wildcard App", slug: "wildcard-app", app_type: "forward_auth", domain_pattern: "*.example.com", active: true)
      sign_in_as(@user)

      get "/api/verify", headers: { "X-Forwarded-Host" => "app.example.com" }
@@ -121,18 +96,20 @@ module Api
      assert_response 200

      get "/api/verify", headers: { "X-Forwarded-Host" => "other.com" }
-      assert_response 200  # Falls back to default behavior
+      assert_response 403  # No rule configured - fail-closed
+      assert_equal "No authentication rule configured for this domain", response.headers["x-auth-reason"]
    end

    test "should match exact domains correctly" do
-      exact_rule = ForwardAuthRule.create!(domain_pattern: "api.example.com", active: true)
+      exact_rule = Application.create!(name: "Exact App", slug: "exact-app", app_type: "forward_auth", domain_pattern: "api.example.com", active: true)
      sign_in_as(@user)

      get "/api/verify", headers: { "X-Forwarded-Host" => "api.example.com" }
      assert_response 200

      get "/api/verify", headers: { "X-Forwarded-Host" => "app.api.example.com" }
-      assert_response 200  # Falls back to default behavior
+      assert_response 403  # No rule configured - fail-closed
+      assert_equal "No authentication rule configured for this domain", response.headers["x-auth-reason"]
    end

    # Header Configuration Tests
@@ -142,14 +119,17 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }

      assert_response 200
-      assert_equal "X-Remote-User", response.headers.keys.find { |k| k.include?("User") }
-      assert_equal "X-Remote-Email", response.headers.keys.find { |k| k.include?("Email") }
-      assert_equal "X-Remote-Name", response.headers.keys.find { |k| k.include?("Name") }
-      assert_equal @user.email_address, response.headers["X-Remote-User"]
+      assert_equal @user.email_address, response.headers["x-remote-user"]
+      assert_equal @user.email_address, response.headers["x-remote-email"]
+      assert response.headers["x-remote-name"].present?
+      assert_equal (@user.admin? ? "true" : "false"), response.headers["x-remote-admin"]
    end

    test "should return custom headers when configured" do
-      custom_rule = ForwardAuthRule.create!(
+      custom_rule = Application.create!(
+        name: "Custom App",
+        slug: "custom-app",
+        app_type: "forward_auth",
        domain_pattern: "custom.example.com",
        active: true,
        headers_config: {
@@ -163,13 +143,18 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "custom.example.com" }

      assert_response 200
-      assert_equal "X-WEBAUTH-USER", response.headers.keys.find { |k| k.include?("USER") }
-      assert_equal "X-WEBAUTH-EMAIL", response.headers.keys.find { |k| k.include?("EMAIL") }
-      assert_equal @user.email_address, response.headers["X-WEBAUTH-USER"]
+      assert_equal @user.email_address, response.headers["x-webauth-user"]
+      assert_equal @user.email_address, response.headers["x-webauth-email"]
+      # Default headers should NOT be present
+      assert_nil response.headers["x-remote-user"]
+      assert_nil response.headers["x-remote-email"]
    end

    test "should return no headers when all headers disabled" do
-      no_headers_rule = ForwardAuthRule.create!(
+      no_headers_rule = Application.create!(
+        name: "No Headers App",
+        slug: "no-headers-app",
+        app_type: "forward_auth",
        domain_pattern: "noheaders.example.com",
        active: true,
        headers_config: { user: "", email: "", name: "", groups: "", admin: "" }
@@ -179,8 +164,9 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "noheaders.example.com" }

      assert_response 200
-      auth_headers = response.headers.select { |k, v| k.match?(/^(X-|Remote-)/i) }
-      assert_empty auth_headers
+      # Check that auth-specific headers are not present (exclude Rails security headers)
+      auth_headers = response.headers.select { |k, v| k.match?(/^X-Remote-/i) || k.match?(/^X-WEBAUTH/i) }
+      assert_empty auth_headers, "Should not have any auth headers when all are disabled"
    end

    test "should include groups header when user has groups" do
@@ -190,16 +176,20 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }

      assert_response 200
-      assert_equal @group.name, response.headers["X-Remote-Groups"]
+      groups_header = response.headers["x-remote-groups"]
+      assert_includes groups_header, @group.name
+      # Bob also has editor_group from fixtures
+      assert_includes groups_header, "Editors"
    end

    test "should not include groups header when user has no groups" do
+      @user.groups.clear  # Remove fixture groups
      sign_in_as(@user)

      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }

      assert_response 200
-      assert_nil response.headers["X-Remote-Groups"]
+      assert_nil response.headers["x-remote-groups"]
    end

    test "should include admin header correctly" do
@@ -208,7 +198,7 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }

      assert_response 200
-      assert_equal "true", response.headers["X-Remote-Admin"]
+      assert_equal "true", response.headers["x-remote-admin"]
    end

    test "should include multiple groups when user has multiple groups" do
@@ -220,7 +210,7 @@ module Api
      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }

      assert_response 200
-      groups_header = response.headers["X-Remote-Groups"]
+      groups_header = response.headers["x-remote-groups"]
      assert_includes groups_header, @group.name
      assert_includes groups_header, group2.name
    end
@@ -239,29 +229,20 @@ module Api

      get "/api/verify"

-      assert_response 200
-      assert_equal "User #{@user.email_address} authenticated (no domain specified)",
-                   request.env["action_dispatch.instance"].instance_variable_get(:@logged_messages)&.last
+      # User is authenticated but no domain rule matches (default test host)
+      assert_response 403
+      assert_equal "No authentication rule configured for this domain", response.headers["x-auth-reason"]
    end

    # Security Tests
-    test "should handle malformed session IDs gracefully" do
-      get "/api/verify", headers: {
-        "X-Forwarded-Host" => "test.example.com",
-        "Cookie" => "_clinch_session_id=malformed_session_id_with_special_chars!@#$%"
-      }
-
-      assert_response 302
-      assert_equal "Invalid session", response.headers["X-Auth-Reason"]
-    end
-
    test "should handle very long domain names" do
      long_domain = "a" * 250 + ".example.com"
      sign_in_as(@user)

      get "/api/verify", headers: { "X-Forwarded-Host" => long_domain }

-      assert_response 200  # Should fall back to default behavior
+      assert_response 403  # No rule configured - fail-closed
+      assert_equal "No authentication rule configured for this domain", response.headers["x-auth-reason"]
    end

    test "should handle case insensitive domain matching" do
@@ -272,66 +253,7 @@ module Api
      assert_response 200
    end

-    # Open Redirect Security Tests
-    test "should redirect to malicious external domain when rd parameter is provided" do
-      # This test demonstrates the current vulnerability
-      evil_url = "https://evil-phishing-site.com/steal-credentials"
-
-      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" },
-          params: { rd: evil_url }
-
-      assert_response 302
-      # Current vulnerable behavior: redirects to the evil URL
-      assert_match evil_url, response.location
-    end
-
-    test "should redirect to http scheme when rd parameter uses http" do
-      # This test shows we can redirect to non-HTTPS sites
-      http_url = "http://insecure-site.com/login"
-
-      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" },
-          params: { rd: http_url }
-
-      assert_response 302
-      assert_match http_url, response.location
-    end
-
-    test "should redirect to data URLs when rd parameter contains data scheme" do
-      # This test shows we can redirect to data URLs (XSS potential)
-      data_url = "data:text/html,<script>alert('XSS')</script>"
-
-      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" },
-          params: { rd: data_url }
-
-      assert_response 302
-      # Currently redirects to data URL (XSS vulnerability)
-      assert_match data_url, response.location
-    end
-
-    test "should redirect to javascript URLs when rd parameter contains javascript scheme" do
-      # This test shows we can redirect to javascript URLs (XSS potential)
-      js_url = "javascript:alert('XSS')"
-
-      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" },
-          params: { rd: js_url }
-
-      assert_response 302
-      # Currently redirects to JavaScript URL (XSS vulnerability)
-      assert_match js_url, response.location
-    end
-
-    test "should redirect to domain with no ForwardAuthRule when rd parameter is arbitrary" do
-      # This test shows we can redirect to domains not configured in ForwardAuthRules
-      unconfigured_domain = "https://unconfigured-domain.com/admin"
-
-      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" },
-          params: { rd: unconfigured_domain }
-
-      assert_response 302
-      # Currently redirects to unconfigured domain
-      assert_match unconfigured_domain, response.location
-    end
-
+    # Open Redirect Security Tests - All tests verify SECURE behavior
    test "should reject malicious redirect URL through session after authentication (SECURE BEHAVIOR)" do
      # This test shows malicious URLs are filtered out through the auth flow
      evil_url = "https://evil-site.com/fake-login"
@@ -364,37 +286,6 @@ module Api
      assert_match "test.example.com", response.location, "Should redirect to legitimate domain"
    end

-    test "should redirect to domain that looks similar but not in ForwardAuthRules" do
-      # Create rule for test.example.com
-      test_rule = ForwardAuthRule.create!(domain_pattern: "test.example.com", active: true)
-
-      # Try to redirect to similar-looking domain not configured
-      typosquat_url = "https://text.example.com/admin"  # Note: 'text' instead of 'test'
-
-      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" },
-          params: { rd: typosquat_url }
-
-      assert_response 302
-      # Currently redirects to typosquat domain
-      assert_match typosquat_url, response.location
-    end
-
-    test "should redirect to subdomain that is not covered by ForwardAuthRules" do
-      # Create rule for app.example.com
-      app_rule = ForwardAuthRule.create!(domain_pattern: "app.example.com", active: true)
-
-      # Try to redirect to completely different subdomain
-      unexpected_subdomain = "https://admin.example.com/panel"
-
-      get "/api/verify", headers: { "X-Forwarded-Host" => "app.example.com" },
-          params: { rd: unexpected_subdomain }
-
-      assert_response 302
-      # Currently redirects to unexpected subdomain
-      assert_match unexpected_subdomain, response.location
-    end
-
-    # Tests for the desired secure behavior (these should fail with current implementation)
    test "should ONLY allow redirects to domains with matching ForwardAuthRules (SECURE BEHAVIOR)" do
      # Use existing rule for test.example.com created in setup

@@ -459,27 +350,15 @@ module Api
      end
    end

-    # HTTP Method Specific Tests (based on Authelia approach)
-    test "should handle different HTTP methods with appropriate redirect codes" do
+    # HTTP Method Tests
+    test "should handle GET requests with appropriate response codes" do
      sign_in_as(@user)

-      # Test GET requests should return 302 Found
+      # Authenticated GET requests should return 200
      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }
-      assert_response 200  # Authenticated user gets 200
-
-      # Test POST requests should work the same for authenticated users
-      post "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }
      assert_response 200
    end

-    test "should return 403 for non-authenticated POST requests instead of redirect" do
-      # This follows Authelia's pattern where non-GET requests to protected resources
-      # should return 403 when unauthenticated, not redirects
-      post "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }
-      assert_response 302  # Our implementation still redirects to login
-      # Note: Could be enhanced to return 403 for non-GET methods
-    end
-
    # XHR/Fetch Request Tests
    test "should handle XHR requests appropriately" do
      get "/api/verify", headers: {
@@ -549,27 +428,30 @@ module Api
        "X-Forwarded-Host" => "测试.example.com"
      }

-      assert_response 200
+      assert_response 403  # No rule configured - fail-closed
+      assert_equal "No authentication rule configured for this domain", response.headers["x-auth-reason"]
    end

    # Protocol and Scheme Tests
    test "should handle X-Forwarded-Proto header" do
+      sign_in_as(@user)
+
      get "/api/verify", headers: {
        "X-Forwarded-Host" => "test.example.com",
        "X-Forwarded-Proto" => "https"
      }

-      sign_in_as(@user)
      assert_response 200
    end

    test "should handle HTTP protocol in X-Forwarded-Proto" do
+      sign_in_as(@user)
+
      get "/api/verify", headers: {
        "X-Forwarded-Host" => "test.example.com",
        "X-Forwarded-Proto" => "http"
      }

-      sign_in_as(@user)
      assert_response 200
      # Note: Our implementation doesn't enforce protocol matching
    end
@@ -587,7 +469,7 @@ module Api
      assert_response 200

      # Should maintain user identity across requests
-      assert_equal @user.email_address, response.headers["X-Remote-User"]
+      assert_equal @user.email_address, response.headers["x-remote-user"]
    end

    test "should handle concurrent requests with same session" do
@@ -600,16 +482,15 @@ module Api
      5.times do |i|
        threads << Thread.new do
          get "/api/verify", headers: { "X-Forwarded-Host" => "app#{i}.example.com" }
-          results << { status: response.status, user: response.headers["X-Remote-User"] }
+          results << { status: response.status }
        end
      end

      threads.each(&:join)

-      # All requests should succeed
+      # All requests should be denied (no rules configured for these domains)
      results.each do |result|
-        assert_equal 200, result[:status]
-        assert_equal @user.email_address, result[:user]
+        assert_equal 403, result[:status]
      end
    end

@@ -624,13 +505,15 @@ module Api
    end

    test "should handle null byte injection in headers" do
+      sign_in_as(@user)
+
      get "/api/verify", headers: {
        "X-Forwarded-Host" => "test.example.com\0.evil.com"
      }

-      sign_in_as(@user)
-      # Should handle null bytes safely
-      assert_response 200
+      # Should handle null bytes safely - domain doesn't match any rule
+      assert_response 403
+      assert_equal "No authentication rule configured for this domain", response.headers["x-auth-reason"]
    end

    # Performance and Load Tests
@@ -642,7 +525,7 @@ module Api

      request_count.times do |i|
        get "/api/verify", headers: { "X-Forwarded-Host" => "app#{i}.example.com" }
-        assert_response 200
+        assert_response 403  # No rules configured for these domains
      end

      total_time = Time.current - start_time
--- a/test/controllers/input_validation_test.rb
+++ b/test/controllers/input_validation_test.rb
@@ -0,0 +1,187 @@
+require "test_helper"
+
+class InputValidationTest < ActionDispatch::IntegrationTest
+  # ====================
+  # SQL INJECTION PREVENTION TESTS
+  # ====================
+
+  test "SQL injection is prevented by Rails ORM" do
+    # Rails ActiveRecord prevents SQL injection through parameterized queries
+    # This test verifies the protection is in place
+
+    # Try SQL injection in email field
+    post signin_path, params: {
+      email_address: "admin' OR '1'='1",
+      password: "password123"
+    }
+
+    # Should not authenticate with SQL injection
+    assert_response :redirect
+    assert_redirected_to signin_path
+    assert_match(/invalid/i, flash[:alert].to_s)
+  end
+
+  # ====================
+  # XSS PREVENTION TESTS
+  # ====================
+
+  test "XSS in user input is escaped" do
+    # Create user with XSS payload in name
+    xss_payload = "<script>alert('XSS')</script>"
+    user = User.create!(email_address: "xss_test@example.com", password: "password123", name: xss_payload)
+
+    # Sign in
+    post signin_path, params: { email_address: "xss_test@example.com", password: "password123" }
+    assert_response :redirect
+
+    # Get a page that displays user name
+    get root_path
+    assert_response :success
+
+    # The XSS payload should be escaped, not executed
+    # Rails automatically escapes output in ERB templates
+
+    user.destroy
+  end
+
+  # ====================
+  # PARAMETER TAMPERING TESTS
+  # ====================
+
+  test "parameter tampering in OAuth authorization is prevented" do
+    user = User.create!(email_address: "oauth_tamper_test@example.com", password: "password123")
+    application = Application.create!(
+      name: "OAuth Test App",
+      slug: "oauth-test-app",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:4000/callback"].to_json,
+      active: true
+    )
+
+    # Sign in
+    post signin_path, params: { email_address: "oauth_tamper_test@example.com", password: "password123" }
+    assert_response :redirect
+
+    # Try to tamper with OAuth authorization parameters
+    get "/oauth/authorize", params: {
+      client_id: application.client_id,
+      redirect_uri: "http://evil.com/callback",  # Tampered redirect URI
+      response_type: "code",
+      scope: "openid profile admin",  # Tampered scope to request admin access
+      user_id: 1  # Tampered user ID
+    }
+
+    # Should reject the tampered redirect URI
+    assert_response :bad_request
+
+    user.sessions.delete_all
+    user.destroy
+    application.destroy
+  end
+
+  test "parameter tampering in token request is prevented" do
+    user = User.create!(email_address: "token_tamper_test@example.com", password: "password123")
+    application = Application.create!(
+      name: "Token Tamper Test App",
+      slug: "token-tamper-test",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:4000/callback"].to_json,
+      active: true
+    )
+
+    # Try to tamper with token request parameters
+    post "/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: "fake_code",
+      redirect_uri: "http://localhost:4000/callback",
+      client_id: "tampered_client_id",
+      user_id: 999  # Tampered user ID
+    }
+
+    # Should reject tampered client_id
+    assert_response :unauthorized
+
+    user.destroy
+    application.destroy
+  end
+
+  # ====================
+  # JSON INPUT VALIDATION TESTS
+  # ====================
+
+  test "JSON input validation prevents malicious payloads" do
+    # Try to send malformed JSON
+    post "/oauth/token", params: '{"grant_type":"authorization_code",}'.to_json,
+      headers: { "CONTENT_TYPE" => "application/json" }
+
+    # Should handle malformed JSON gracefully
+    assert_includes [400, 422], response.status
+  end
+
+  test "JSON input sanitization prevents injection" do
+    # Try JSON injection attacks
+    post "/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: "test_code",
+      redirect_uri: "http://localhost:4000/callback",
+      nested: { __proto__: "tampered", constructor: { prototype: "tampered" } }
+    }.to_json,
+    headers: { "CONTENT_TYPE" => "application/json" }
+
+    # Should sanitize or reject prototype pollution attempts
+    # The request should be handled (either accept or reject, not crash)
+    assert response.body.present?
+  end
+
+  # ====================
+  # HEADER INJECTION TESTS
+  # ====================
+
+  test "HTTP header injection is prevented" do
+    # Try to inject headers via user input
+    malicious_input = "value\r\nX-Injected-Header: malicious"
+
+    post signin_path, params: {
+      email_address: malicious_input,
+      password: "password123"
+    }
+
+    # Should sanitize or reject header injection attempts
+    assert_nil response.headers["X-Injected-Header"]
+  end
+
+  # ====================
+  # PATH TRAVERSAL TESTS
+  # ====================
+
+  test "path traversal is prevented" do
+    # Try to access files outside intended directory
+    malicious_paths = [
+      "../../../etc/passwd",
+      "..\\..\\..\\windows\\system32\\drivers\\etc\\hosts",
+      "/etc/passwd",
+      "C:\\Windows\\System32\\config\\sam"
+    ]
+
+    malicious_paths.each do |malicious_path|
+      # Try to access files with path traversal
+      get root_path, params: { file: malicious_path }
+
+      # Should prevent access to files outside public directory
+      assert_response :redirect, "Should reject path traversal attempt"
+    end
+  end
+
+  test "null byte injection is prevented" do
+    # Try null byte injection
+    malicious_input = "test\x00@example.com"
+
+    post signin_path, params: {
+      email_address: malicious_input,
+      password: "password123"
+    }
+
+    # Should sanitize null bytes
+    assert_response :redirect
+  end
+end
--- a/test/controllers/oidc_authorization_code_security_test.rb
+++ b/test/controllers/oidc_authorization_code_security_test.rb
@@ -0,0 +1,867 @@
+require "test_helper"
+
+class OidcAuthorizationCodeSecurityTest < ActionDispatch::IntegrationTest
+  def setup
+    @user = User.create!(email_address: "security_test@example.com", password: "password123")
+    @application = Application.create!(
+      name: "Security Test App",
+      slug: "security-test-app",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:4000/callback"].to_json,
+      active: true,
+      require_pkce: false
+    )
+
+    # Store the plain text client secret for testing
+    @client_secret = @application.client_secret_digest
+    @application.generate_new_client_secret!
+    @plain_client_secret = @application.client_secret
+    @application.save!
+  end
+
+  def teardown
+    # Delete in correct order to avoid foreign key constraints
+    OidcRefreshToken.where(application: @application).delete_all
+    OidcAccessToken.where(application: @application).delete_all
+    OidcAuthorizationCode.where(application: @application).delete_all
+    OidcUserConsent.where(application: @application).delete_all
+    @user.destroy
+    @application.destroy
+  end
+
+  # ====================
+  # CRITICAL SECURITY TESTS
+  # ====================
+
+  test "prevents authorization code reuse - sequential attempts" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create a valid authorization code
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    # First request should succeed
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :success
+    first_response = JSON.parse(@response.body)
+    assert first_response.key?("access_token")
+    assert first_response.key?("id_token")
+
+    # Second request with same code should fail
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_grant", error["error"]
+    assert_match(/already been used/, error["error_description"])
+  end
+
+  test "revokes existing tokens when authorization code is reused" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create a valid authorization code
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    # First request - get access token
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :success
+    first_response = JSON.parse(@response.body)
+    first_access_token = first_response["access_token"]
+
+    # Verify the token works
+    get "/oauth/userinfo", headers: {
+      "Authorization" => "Bearer #{first_access_token}"
+    }
+    assert_response :success
+
+    # Second request with same code - should fail AND revoke first token
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+
+    # Verify the first token is now revoked (expired)
+    get "/oauth/userinfo", headers: {
+      "Authorization" => "Bearer #{first_access_token}"
+    }
+    assert_response :unauthorized, "First access token should be revoked after code reuse"
+  end
+
+  test "rejects already used authorization code" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create and mark code as used
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      used: true,
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_grant", error["error"]
+    assert_match(/already been used/, error["error_description"])
+  end
+
+  test "rejects expired authorization code" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create expired code
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 5.minutes.ago
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_grant", error["error"]
+    assert_match(/expired/, error["error_description"])
+  end
+
+  test "rejects authorization code with mismatched redirect_uri" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://evil.com/callback" # Wrong redirect URI
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_grant", error["error"]
+    assert_match(/Redirect URI mismatch/, error["error_description"])
+  end
+
+  test "rejects non-existent authorization code" do
+    token_params = {
+      grant_type: "authorization_code",
+      code: "nonexistent_code_12345",
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_grant", error["error"]
+  end
+
+  test "rejects authorization code for different application" do
+    # Create consent for the first application
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create another application
+    other_app = Application.create!(
+      name: "Other App",
+      slug: "other-app",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:5000/callback"].to_json,
+      active: true,
+      require_pkce: false
+    )
+    other_secret = other_app.client_secret
+
+    # Create auth code for first application
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Try to use it with different application credentials
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{other_app.client_id}:#{other_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_grant", error["error"]
+
+    other_app.destroy
+  end
+
+  # ====================
+  # CLIENT AUTHENTICATION TESTS
+  # ====================
+
+  test "rejects invalid client_id in Basic auth" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("invalid_client_id:#{@plain_client_secret}")
+    }
+
+    assert_response :unauthorized
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_client", error["error"]
+  end
+
+  test "rejects invalid client_secret in Basic auth" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:wrong_secret")
+    }
+
+    assert_response :unauthorized
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_client", error["error"]
+  end
+
+  test "accepts client credentials in POST body" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback",
+      client_id: @application.client_id,
+      client_secret: @plain_client_secret
+    }
+
+    post "/oauth/token", params: token_params
+
+    assert_response :success
+    response_body = JSON.parse(@response.body)
+    assert response_body.key?("access_token")
+    assert response_body.key?("id_token")
+  end
+
+  test "rejects request with no client authentication" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params
+
+    assert_response :unauthorized
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_client", error["error"]
+  end
+
+  # ====================
+  # GRANT TYPE VALIDATION
+  # ====================
+
+  test "rejects unsupported grant_type" do
+    post "/oauth/token", params: {
+      grant_type: "password",
+      username: "user",
+      password: "pass"
+    }, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "unsupported_grant_type", error["error"]
+  end
+
+  test "rejects missing grant_type" do
+    post "/oauth/token", params: {
+      code: "some_code",
+      redirect_uri: "http://localhost:4000/callback"
+    }, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "unsupported_grant_type", error["error"]
+  end
+
+  # ====================
+  # TIMING ATTACK PROTECTION
+  # ====================
+
+  test "client authentication uses constant-time comparison" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    # Test with completely wrong secret
+    times_wrong = []
+    5.times do
+      start_time = Time.now.to_f
+      post "/oauth/token", params: token_params, headers: {
+        "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:wrong_secret_xxx")
+      }
+      times_wrong << (Time.now.to_f - start_time)
+      assert_response :unauthorized
+    end
+
+    # Test with almost correct secret (differs by one character)
+    correct_secret = @plain_client_secret
+    almost_correct = correct_secret[0..-2] + "X"
+
+    times_almost = []
+    5.times do
+      start_time = Time.now.to_f
+      post "/oauth/token", params: token_params, headers: {
+        "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{almost_correct}")
+      }
+      times_almost << (Time.now.to_f - start_time)
+      assert_response :unauthorized
+    end
+
+    # The timing difference should be minimal (within 50ms) if using constant-time comparison
+    avg_wrong = times_wrong.sum / times_wrong.size
+    avg_almost = times_almost.sum / times_almost.size
+    timing_difference = (avg_wrong - avg_almost).abs
+
+    # This is a best-effort check - in practice, constant-time comparison is handled by bcrypt
+    assert timing_difference < 0.05,
+      "Timing difference #{timing_difference}s suggests potential timing attack vulnerability"
+  end
+
+  # ====================
+  # STATE PARAMETER BINDING (CSRF PREVENTION FOR OAUTH)
+  # ====================
+
+  test "state parameter is required and validated in authorization flow" do
+    # Create consent to skip consent page
+    OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Sign in first
+    post signin_path, params: { email_address: "security_test@example.com", password: "password123" }
+
+    # Test authorization with state parameter
+    get "/oauth/authorize", params: {
+      client_id: @application.client_id,
+      redirect_uri: "http://localhost:4000/callback",
+      response_type: "code",
+      scope: "openid profile",
+      state: "random_state_123"
+    }
+
+    # Should include state in redirect
+    assert_response :redirect
+    assert_match(/state=random_state_123/, response.location)
+  end
+
+  test "authorization without state parameter still works but is less secure" do
+    # Create consent to skip consent page
+    OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Sign in first
+    post signin_path, params: { email_address: "security_test@example.com", password: "password123" }
+
+    # Test authorization without state parameter
+    get "/oauth/authorize", params: {
+      client_id: @application.client_id,
+      redirect_uri: "http://localhost:4000/callback",
+      response_type: "code",
+      scope: "openid profile"
+    }
+
+    # Should work but state is recommended for CSRF protection
+    assert_response :redirect
+  end
+
+  # ====================
+  # NONCE PARAMETER VALIDATION (FOR ID TOKENS)
+  # ====================
+
+  test "nonce parameter is included in ID token" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code with nonce
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      nonce: "test_nonce_123",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Exchange code for tokens
+    post "/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :success
+    response_body = JSON.parse(@response.body)
+    id_token = response_body["id_token"]
+
+    # Decode ID token (without verification for this test)
+    decoded_token = JWT.decode(id_token, nil, false)
+
+    # Verify nonce is included in ID token
+    assert_equal "test_nonce_123", decoded_token[0]["nonce"]
+  end
+
+  # ====================
+  # TOKEN LEAKAGE VIA REFERER HEADER TESTS
+  # ====================
+
+  test "access tokens are not exposed in referer header" do
+    # Create consent and authorization code
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Exchange code for tokens
+    post "/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :success
+    response_body = JSON.parse(@response.body)
+    access_token = response_body["access_token"]
+
+    # Verify token is not in response headers (especially Referer)
+    assert_nil response.headers["Referer"], "Access token should not leak in Referer header"
+    assert_nil response.headers["Location"], "Access token should not leak in Location header"
+  end
+
+  # ====================
+  # PKCE ENFORCEMENT FOR PUBLIC CLIENTS TESTS
+  # ====================
+
+  test "PKCE code_verifier is required when code_challenge was provided" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code with PKCE challenge
+    code_verifier = SecureRandom.urlsafe_base64(32)
+    code_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: code_challenge,
+      code_challenge_method: "S256",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Try to exchange code without code_verifier
+    post "/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_request", error["error"]
+    assert_match(/code_verifier is required/, error["error_description"])
+  end
+
+  test "PKCE with S256 method validates correctly" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code with PKCE S256
+    code_verifier = SecureRandom.urlsafe_base64(32)
+    code_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: code_challenge,
+      code_challenge_method: "S256",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Exchange code with correct code_verifier
+    post "/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback",
+      code_verifier: code_verifier
+    }, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :success
+    response_body = JSON.parse(@response.body)
+    assert response_body.key?("access_token")
+  end
+
+  test "PKCE rejects invalid code_verifier" do
+    # Create consent
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code with PKCE
+    code_verifier = SecureRandom.urlsafe_base64(32)
+    code_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: code_challenge,
+      code_challenge_method: "S256",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Try with wrong code_verifier
+    post "/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback",
+      code_verifier: "wrong_code_verifier_12345678901234567890"
+    }, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_request", error["error"]
+  end
+
+  # ====================
+  # REFRESH TOKEN ROTATION TESTS
+  # ====================
+
+  test "refresh token rotation is enforced" do
+    # Create consent for the refresh token endpoint
+    consent = OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create initial access and refresh tokens
+    access_token = OidcAccessToken.create!(
+      application: @application,
+      user: @user,
+      scope: "openid profile"
+    )
+
+    refresh_token = OidcRefreshToken.create!(
+      application: @application,
+      user: @user,
+      oidc_access_token: access_token,
+      scope: "openid profile"
+    )
+
+    original_token_family_id = refresh_token.token_family_id
+    old_refresh_token = refresh_token.token
+
+    # Refresh the token
+    post "/oauth/token", params: {
+      grant_type: "refresh_token",
+      refresh_token: old_refresh_token
+    }, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@plain_client_secret}")
+    }
+
+    assert_response :success
+    response_body = JSON.parse(@response.body)
+    new_refresh_token = response_body["refresh_token"]
+
+    # Verify new refresh token is different
+    assert_not_equal old_refresh_token, new_refresh_token
+
+    # Verify token family is preserved
+    new_token_record = OidcRefreshToken.where(application: @application).find do |rt|
+      rt.token_matches?(new_refresh_token)
+    end
+    assert_equal original_token_family_id, new_token_record.token_family_id
+
+    # Old refresh token should be revoked
+    old_token_record = OidcRefreshToken.find(refresh_token.id)
+    assert old_token_record.revoked?
+  end
+end
--- a/test/controllers/oidc_pkce_controller_test.rb
+++ b/test/controllers/oidc_pkce_controller_test.rb
@@ -0,0 +1,539 @@
+require "test_helper"
+
+class OidcPkceControllerTest < ActionDispatch::IntegrationTest
+  def setup
+    @user = User.create!(email_address: "pkce_test@example.com", password: "password123")
+    @application = Application.create!(
+      name: "PKCE Test App",
+      slug: "pkce-test-app",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:4000/callback"].to_json,
+      active: true
+    )
+
+    # Sign in the user using the test helper
+    sign_in_as(@user)
+  end
+
+  def teardown
+    Current.session&.destroy
+    # Delete in correct order to avoid foreign key constraints
+    OidcRefreshToken.where(application: @application).delete_all
+    OidcAccessToken.where(application: @application).delete_all
+    OidcAuthorizationCode.where(application: @application).delete_all
+    OidcUserConsent.where(application: @application).delete_all
+    @user.destroy
+    @application.destroy
+  end
+
+  test "discovery endpoint includes PKCE support" do
+    get "/.well-known/openid-configuration"
+
+    assert_response :success
+    config = JSON.parse(@response.body)
+
+    assert config.key?("code_challenge_methods_supported")
+    assert_includes config["code_challenge_methods_supported"], "S256"
+    assert_includes config["code_challenge_methods_supported"], "plain"
+  end
+
+  test "authorization endpoint accepts PKCE parameters (S256)" do
+    code_verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
+    code_challenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+
+    auth_params = {
+      response_type: "code",
+      client_id: @application.client_id,
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      state: "test_state",
+      nonce: "test_nonce",
+      code_challenge: code_challenge,
+      code_challenge_method: "S256"
+    }
+
+    get "/oauth/authorize", params: auth_params
+
+    # Should show consent page (user is already authenticated)
+    assert_response :success
+    assert_match /consent/, @response.body.downcase
+  end
+
+  test "authorization endpoint accepts PKCE parameters (plain)" do
+    code_challenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+
+    auth_params = {
+      response_type: "code",
+      client_id: @application.client_id,
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      state: "test_state",
+      nonce: "test_nonce",
+      code_challenge: code_challenge,
+      code_challenge_method: "plain"
+    }
+
+    get "/oauth/authorize", params: auth_params
+
+    # Should show consent page (user is already authenticated)
+    assert_response :success
+    assert_match /consent/, @response.body.downcase
+  end
+
+  test "authorization endpoint rejects invalid code_challenge_method" do
+    auth_params = {
+      response_type: "code",
+      client_id: @application.client_id,
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+      code_challenge_method: "invalid_method"
+    }
+
+    get "/oauth/authorize", params: auth_params
+
+    assert_response :bad_request
+    assert_match(/Invalid code_challenge_method/, @response.body)
+  end
+
+  test "authorization endpoint rejects invalid code_challenge format" do
+    # Contains + character which is not base64url
+    auth_params = {
+      response_type: "code",
+      client_id: @application.client_id,
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: "invalid+challenge",
+      code_challenge_method: "S256"
+    }
+
+    get "/oauth/authorize", params: auth_params
+
+    assert_response :bad_request
+    assert_match(/Invalid code_challenge format/, @response.body)
+  end
+
+  test "token endpoint requires code_verifier when PKCE was used (S256)" do
+    # Create consent for token endpoint
+    OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code with PKCE S256
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+      code_challenge_method: "S256",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@application.client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_request", error["error"]
+    assert_match(/code_verifier is required/, error["error_description"])
+  end
+
+  test "token endpoint requires code_verifier when PKCE was used (plain)" do
+    # Create consent for token endpoint
+    OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code with PKCE plain
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+      code_challenge_method: "plain",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@application.client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_request", error["error"]
+    assert_match(/code_verifier is required/, error["error_description"])
+  end
+
+  test "token endpoint rejects invalid code_verifier (S256)" do
+    # Create consent for token endpoint
+    OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code with PKCE S256
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+      code_challenge_method: "S256",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback",
+      # Use a properly formatted but wrong verifier (43+ chars, base64url)
+      code_verifier: "wrongverifier_with_enough_characters_base64url"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@application.client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_grant", error["error"]
+    assert_match(/Invalid code verifier/, error["error_description"])
+  end
+
+  test "token endpoint accepts valid code_verifier (S256)" do
+    # Create consent for token endpoint
+    OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Generate valid PKCE pair
+    code_verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
+    code_challenge = Digest::SHA256.base64digest(code_verifier)
+      .tr("+/", "-_")
+      .tr("=", "")
+
+    # Create authorization code with PKCE S256
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: code_challenge,
+      code_challenge_method: "S256",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback",
+      code_verifier: code_verifier
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@application.client_secret}")
+    }
+
+    assert_response :success
+    tokens = JSON.parse(@response.body)
+    assert tokens.key?("access_token")
+    assert tokens.key?("id_token")
+    assert_equal "Bearer", tokens["token_type"]
+  end
+
+  test "token endpoint accepts valid code_verifier (plain)" do
+    # Create consent for token endpoint
+    OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    code_verifier = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+
+    # Create authorization code with PKCE plain
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      code_challenge: code_verifier, # Same as verifier for plain method
+      code_challenge_method: "plain",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback",
+      code_verifier: code_verifier
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@application.client_secret}")
+    }
+
+    assert_response :success
+    tokens = JSON.parse(@response.body)
+    assert tokens.key?("access_token")
+    assert tokens.key?("id_token")
+    assert_equal "Bearer", tokens["token_type"]
+  end
+
+  test "token endpoint works without PKCE (backward compatibility)" do
+    # Create an application with PKCE not required (legacy behavior)
+    legacy_app = Application.create!(
+      name: "Legacy App",
+      slug: "legacy-app",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:5000/callback"].to_json,
+      active: true,
+      require_pkce: false
+    )
+    legacy_app.generate_new_client_secret!
+
+    # Create consent for token endpoint
+    OidcUserConsent.create!(
+      user: @user,
+      application: legacy_app,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code without PKCE
+    auth_code = OidcAuthorizationCode.create!(
+      application: legacy_app,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:5000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:5000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{legacy_app.client_id}:#{legacy_app.client_secret}")
+    }
+
+    assert_response :success
+    tokens = JSON.parse(@response.body)
+    assert tokens.key?("access_token")
+    assert tokens.key?("id_token")
+    assert_equal "Bearer", tokens["token_type"]
+
+    # Cleanup
+    OidcRefreshToken.where(application: legacy_app).delete_all
+    OidcAccessToken.where(application: legacy_app).delete_all
+    OidcAuthorizationCode.where(application: legacy_app).delete_all
+    OidcUserConsent.where(application: legacy_app).delete_all
+    legacy_app.destroy
+  end
+
+  # ====================
+  # PUBLIC CLIENT TESTS
+  # ====================
+
+  test "public client can authenticate with PKCE" do
+    # Create a public client (no client_secret)
+    public_app = Application.create!(
+      name: "Public App",
+      slug: "public-app",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:6000/callback"].to_json,
+      active: true,
+      is_public_client: true
+    )
+
+    assert public_app.public_client?
+    assert public_app.requires_pkce?
+    assert_nil public_app.client_secret_digest
+
+    # Create consent
+    OidcUserConsent.create!(
+      user: @user,
+      application: public_app,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # PKCE parameters
+    code_verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
+    code_challenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+
+    # Create authorization code with PKCE
+    auth_code = OidcAuthorizationCode.create!(
+      application: public_app,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:6000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now,
+      code_challenge: code_challenge,
+      code_challenge_method: "S256"
+    )
+
+    # Token request with PKCE but no client_secret
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:6000/callback",
+      client_id: public_app.client_id,
+      code_verifier: code_verifier
+    }
+
+    post "/oauth/token", params: token_params
+
+    assert_response :success
+    tokens = JSON.parse(@response.body)
+    assert tokens.key?("access_token")
+    assert tokens.key?("id_token")
+
+    # Cleanup
+    OidcRefreshToken.where(application: public_app).delete_all
+    OidcAccessToken.where(application: public_app).delete_all
+    OidcAuthorizationCode.where(application: public_app).delete_all
+    OidcUserConsent.where(application: public_app).delete_all
+    public_app.destroy
+  end
+
+  test "public client fails without PKCE" do
+    # Create a public client (no client_secret)
+    public_app = Application.create!(
+      name: "Public App No PKCE",
+      slug: "public-app-no-pkce",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:7000/callback"].to_json,
+      active: true,
+      is_public_client: true
+    )
+
+    assert public_app.public_client?
+    assert public_app.requires_pkce?
+
+    # Create consent
+    OidcUserConsent.create!(
+      user: @user,
+      application: public_app,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-123"
+    )
+
+    # Create authorization code WITHOUT PKCE
+    auth_code = OidcAuthorizationCode.create!(
+      application: public_app,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:7000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Token request without PKCE should fail
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:7000/callback",
+      client_id: public_app.client_id
+    }
+
+    post "/oauth/token", params: token_params
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_request", error["error"]
+    assert_match /PKCE is required for public clients/, error["error_description"]
+
+    # Cleanup
+    OidcRefreshToken.where(application: public_app).delete_all
+    OidcAccessToken.where(application: public_app).delete_all
+    OidcAuthorizationCode.where(application: public_app).delete_all
+    OidcUserConsent.where(application: public_app).delete_all
+    public_app.destroy
+  end
+
+  test "confidential client with require_pkce fails without PKCE" do
+    # The default @application has require_pkce: true (default)
+    assert @application.confidential_client?
+    assert @application.requires_pkce?
+
+    # Create consent
+    OidcUserConsent.create!(
+      user: @user,
+      application: @application,
+      scopes_granted: "openid profile",
+      granted_at: Time.current,
+      sid: "test-sid-pkce-required"
+    )
+
+    # Create authorization code WITHOUT PKCE
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: "http://localhost:4000/callback",
+      scope: "openid profile",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Token request without PKCE should fail
+    token_params = {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: "http://localhost:4000/callback"
+    }
+
+    post "/oauth/token", params: token_params, headers: {
+      "Authorization" => "Basic " + Base64.strict_encode64("#{@application.client_id}:#{@application.client_secret}")
+    }
+
+    assert_response :bad_request
+    error = JSON.parse(@response.body)
+    assert_equal "invalid_request", error["error"]
+    assert_match /PKCE is required/, error["error_description"]
+  end
+end
--- a/test/controllers/oidc_refresh_token_controller_test.rb
+++ b/test/controllers/oidc_refresh_token_controller_test.rb
@@ -0,0 +1,235 @@
+require "test_helper"
+
+class OidcRefreshTokenControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    @user = users(:alice)
+    @application = applications(:kavita_app)
+    # Store a known client secret for testing
+    @client_secret = SecureRandom.urlsafe_base64(48)
+    @application.client_secret = @client_secret
+    @application.save!
+  end
+
+  test "token endpoint returns refresh_token with authorization_code grant" do
+    # Create an authorization code
+    auth_code = OidcAuthorizationCode.create!(
+      application: @application,
+      user: @user,
+      code: SecureRandom.urlsafe_base64(32),
+      redirect_uri: @application.parsed_redirect_uris.first,
+      scope: "openid profile email",
+      expires_at: 10.minutes.from_now
+    )
+
+    # Exchange authorization code for tokens
+    post "/oauth/token", params: {
+      grant_type: "authorization_code",
+      code: auth_code.code,
+      redirect_uri: @application.parsed_redirect_uris.first,
+      client_id: @application.client_id,
+      client_secret: @client_secret
+    }
+
+    assert_response :success
+    json = JSON.parse(response.body)
+
+    assert json["access_token"].present?
+    assert json["id_token"].present?
+    assert json["refresh_token"].present?
+    assert_equal "Bearer", json["token_type"]
+    assert_equal 3600, json["expires_in"]
+  end
+
+  test "refresh_token grant exchanges refresh token for new tokens" do
+    # Create access and refresh tokens
+    access_token = OidcAccessToken.create!(
+      application: @application,
+      user: @user,
+      scope: "openid profile email"
+    )
+
+    refresh_token = OidcRefreshToken.create!(
+      application: @application,
+      user: @user,
+      oidc_access_token: access_token,
+      scope: "openid profile email"
+    )
+
+    # Store the plaintext refresh token (available only during creation)
+    plaintext_refresh_token = refresh_token.token
+
+    # Use refresh token to get new tokens
+    post "/oauth/token", params: {
+      grant_type: "refresh_token",
+      refresh_token: plaintext_refresh_token,
+      client_id: @application.client_id,
+      client_secret: @client_secret
+    }
+
+    assert_response :success
+    json = JSON.parse(response.body)
+
+    assert json["access_token"].present?
+    assert json["id_token"].present?
+    assert json["refresh_token"].present?
+    assert_equal "Bearer", json["token_type"]
+
+    # Old refresh token should be revoked
+    assert refresh_token.reload.revoked?
+  end
+
+  test "refresh_token grant fails with expired refresh token" do
+    access_token = OidcAccessToken.create!(
+      application: @application,
+      user: @user,
+      scope: "openid profile email"
+    )
+
+    refresh_token = OidcRefreshToken.create!(
+      application: @application,
+      user: @user,
+      oidc_access_token: access_token,
+      scope: "openid profile email",
+      expires_at: 1.hour.ago  # Expired
+    )
+
+    plaintext_refresh_token = refresh_token.token
+
+    post "/oauth/token", params: {
+      grant_type: "refresh_token",
+      refresh_token: plaintext_refresh_token,
+      client_id: @application.client_id,
+      client_secret: @client_secret
+    }
+
+    assert_response :bad_request
+    json = JSON.parse(response.body)
+    assert_equal "invalid_grant", json["error"]
+  end
+
+  test "refresh_token grant fails with revoked refresh token" do
+    access_token = OidcAccessToken.create!(
+      application: @application,
+      user: @user,
+      scope: "openid profile email"
+    )
+
+    refresh_token = OidcRefreshToken.create!(
+      application: @application,
+      user: @user,
+      oidc_access_token: access_token,
+      scope: "openid profile email"
+    )
+
+    plaintext_refresh_token = refresh_token.token
+    refresh_token.revoke!
+
+    post "/oauth/token", params: {
+      grant_type: "refresh_token",
+      refresh_token: plaintext_refresh_token,
+      client_id: @application.client_id,
+      client_secret: @client_secret
+    }
+
+    assert_response :bad_request
+    json = JSON.parse(response.body)
+    assert_equal "invalid_grant", json["error"]
+  end
+
+  test "token revocation endpoint revokes access tokens" do
+    access_token = OidcAccessToken.create!(
+      application: @application,
+      user: @user,
+      scope: "openid profile email"
+    )
+
+    plaintext_access_token = access_token.plaintext_token
+
+    post "/oauth/revoke", params: {
+      token: plaintext_access_token,
+      token_type_hint: "access_token",
+      client_id: @application.client_id,
+      client_secret: @client_secret
+    }
+
+    assert_response :success
+    assert access_token.reload.revoked?
+  end
+
+  test "token revocation endpoint revokes refresh tokens" do
+    access_token = OidcAccessToken.create!(
+      application: @application,
+      user: @user,
+      scope: "openid profile email"
+    )
+
+    refresh_token = OidcRefreshToken.create!(
+      application: @application,
+      user: @user,
+      oidc_access_token: access_token,
+      scope: "openid profile email"
+    )
+
+    plaintext_refresh_token = refresh_token.token
+
+    post "/oauth/revoke", params: {
+      token: plaintext_refresh_token,
+      token_type_hint: "refresh_token",
+      client_id: @application.client_id,
+      client_secret: @client_secret
+    }
+
+    assert_response :success
+    assert refresh_token.reload.revoked?
+  end
+
+  test "token rotation: new refresh token has same family id" do
+    access_token = OidcAccessToken.create!(
+      application: @application,
+      user: @user,
+      scope: "openid profile email"
+    )
+
+    old_refresh_token = OidcRefreshToken.create!(
+      application: @application,
+      user: @user,
+      oidc_access_token: access_token,
+      scope: "openid profile email"
+    )
+
+    family_id = old_refresh_token.token_family_id
+    plaintext_refresh_token = old_refresh_token.token
+
+    post "/oauth/token", params: {
+      grant_type: "refresh_token",
+      refresh_token: plaintext_refresh_token,
+      client_id: @application.client_id,
+      client_secret: @client_secret
+    }
+
+    assert_response :success
+
+    # Find the new refresh token
+    new_refresh_token = OidcRefreshToken.active.where(user: @user, application: @application).last
+    assert_equal family_id, new_refresh_token.token_family_id
+  end
+
+  test "userinfo endpoint works with hashed access token" do
+    access_token = OidcAccessToken.create!(
+      application: @application,
+      user: @user,
+      scope: "openid profile email"
+    )
+
+    plaintext_token = access_token.plaintext_token
+
+    get "/oauth/userinfo", headers: {
+      "Authorization" => "Bearer #{plaintext_token}"
+    }
+
+    assert_response :success
+    json = JSON.parse(response.body)
+    assert_equal @user.id.to_s, json["sub"]
+    assert_equal @user.email_address, json["email"]
+  end
+end
--- a/test/controllers/passwords_controller_test.rb
+++ b/test/controllers/passwords_controller_test.rb
@@ -11,7 +11,7 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
  test "create" do
    post passwords_path, params: { email_address: @user.email_address }
    assert_enqueued_email_with PasswordsMailer, :reset, args: [ @user ]
-    assert_redirected_to new_session_path
+    assert_redirected_to signin_path

    follow_redirect!
    assert_notice "reset instructions sent"
@@ -20,14 +20,14 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest
  test "create for an unknown user redirects but sends no mail" do
    post passwords_path, params: { email_address: "missing-user@example.com" }
    assert_enqueued_emails 0
-    assert_redirected_to new_session_path
+    assert_redirected_to signin_path

    follow_redirect!
    assert_notice "reset instructions sent"
  end

  test "edit" do
-    get edit_password_path(@user.password_reset_token)
+    get edit_password_path(@user.generate_token_for(:password_reset))
    assert_response :success
  end

@@ -41,8 +41,8 @@ class PasswordsControllerTest < ActionDispatch::IntegrationTest

  test "update" do
    assert_changes -> { @user.reload.password_digest } do
-      put password_path(@user.password_reset_token), params: { password: "new", password_confirmation: "new" }
-      assert_redirected_to new_session_path
+      put password_path(@user.generate_token_for(:password_reset)), params: { password: "newpassword", password_confirmation: "newpassword" }
+      assert_redirected_to signin_path
    end

    follow_redirect!
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -18,7 +18,7 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
  test "create with invalid credentials" do
    post session_path, params: { email_address: @user.email_address, password: "wrong" }

-    assert_redirected_to new_session_path
+    assert_redirected_to signin_path
    assert_nil cookies[:session_id]
  end

@@ -27,7 +27,7 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest

    delete session_path

-    assert_redirected_to new_session_path
+    assert_redirected_to signin_path
    assert_empty cookies[:session_id]
  end
 end
--- a/test/controllers/totp_security_test.rb
+++ b/test/controllers/totp_security_test.rb
@@ -0,0 +1,282 @@
+require "test_helper"
+
+class TotpSecurityTest < ActionDispatch::IntegrationTest
+  # ====================
+  # TOTP CODE REPLAY PREVENTION TESTS
+  # ====================
+
+  test "TOTP code cannot be reused" do
+    user = User.create!(email_address: "totp_replay_test@example.com", password: "password123")
+    user.enable_totp!
+
+    # Generate a valid TOTP code
+    totp = ROTP::TOTP.new(user.totp_secret)
+    valid_code = totp.now
+
+    # Set up pending TOTP session
+    post signin_path, params: { email_address: "totp_replay_test@example.com", password: "password123" }
+    assert_redirected_to totp_verification_path
+
+    # First use of the code should succeed
+    post totp_verification_path, params: { code: valid_code }
+    assert_response :redirect
+    assert_redirected_to root_path
+
+    # Sign out
+    delete session_path
+    assert_response :redirect
+
+    # Note: In the current implementation, TOTP codes CAN be reused within the 60-second time window
+    # This is standard TOTP behavior. For enhanced security, you could implement used code tracking.
+    # This test documents the current behavior - codes work within their time window
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  # ====================
+  # BACKUP CODE SINGLE-USE ENFORCEMENT TESTS
+  # ====================
+
+  test "backup code can only be used once" do
+    user = User.create!(email_address: "backup_code_test@example.com", password: "password123")
+
+    # Enable TOTP and generate backup codes
+    user.totp_secret = ROTP::Base32.random
+    backup_codes = user.send(:generate_backup_codes) # Call private method
+    user.save!
+
+    # Store the original backup codes for comparison
+    original_codes = user.reload.backup_codes
+
+    # Set up pending TOTP session
+    post signin_path, params: { email_address: "backup_code_test@example.com", password: "password123" }
+    assert_redirected_to totp_verification_path
+
+    # Use a backup code
+    backup_code = backup_codes.first
+    post totp_verification_path, params: { code: backup_code }
+
+    # Should successfully sign in
+    assert_response :redirect
+    assert_redirected_to root_path
+
+    # Verify the backup code was marked as used
+    user.reload
+    assert_not_equal original_codes, user.backup_codes
+
+    # Try to use the same backup code again
+    delete session_path
+    assert_response :redirect
+
+    # Sign in again
+    post signin_path, params: { email_address: "backup_code_test@example.com", password: "password123" }
+    assert_redirected_to totp_verification_path
+
+    # Try the same backup code
+    post totp_verification_path, params: { code: backup_code }
+
+    # Should fail - backup code already used
+    assert_response :redirect
+    assert_redirected_to totp_verification_path
+    follow_redirect!
+    assert_match(/invalid/i, flash[:alert].to_s)
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  test "backup codes are hashed and not stored in plaintext" do
+    user = User.create!(email_address: "backup_hash_test@example.com", password: "password123")
+
+    # Generate backup codes
+    user.totp_secret = ROTP::Base32.random
+    backup_codes = user.send(:generate_backup_codes) # Call private method
+    user.save!
+
+    # Check that stored codes are BCrypt hashes (start with $2a$)
+    # backup_codes is already an Array (JSON column), no need to parse
+    user.backup_codes.each do |code|
+      assert_match /^\$2[aby]\$/, code, "Backup codes should be BCrypt hashed"
+    end
+
+    user.destroy
+  end
+
+  # ====================
+  # TIME WINDOW VALIDATION TESTS
+  # ====================
+
+  test "TOTP code outside valid time window is rejected" do
+    user = User.create!(email_address: "totp_time_test@example.com", password: "password123")
+
+    # Enable TOTP with backup codes
+    user.totp_secret = ROTP::Base32.random
+    user.send(:generate_backup_codes)
+    user.save!
+
+    # Set up pending TOTP session
+    post signin_path, params: { email_address: "totp_time_test@example.com", password: "password123" }
+    assert_redirected_to totp_verification_path
+
+    # Generate a TOTP code for a time far in the future (outside valid window)
+    totp = ROTP::TOTP.new(user.totp_secret)
+    future_code = totp.at(Time.now.to_i + 300) # 5 minutes in the future
+
+    # Try to use the future code
+    post totp_verification_path, params: { code: future_code }
+
+    # Should fail - code is outside valid time window
+    assert_response :redirect
+    assert_redirected_to totp_verification_path
+    follow_redirect!
+    assert_match(/invalid/i, flash[:alert].to_s)
+
+    user.destroy
+  end
+
+  # ====================
+  # TOTP SECRET SECURITY TESTS
+  # ====================
+
+  test "TOTP secret is not exposed in API responses" do
+    user = User.create!(email_address: "totp_secret_test@example.com", password: "password123")
+    user.enable_totp!
+
+    # Verify the TOTP secret exists (sanity check)
+    assert user.totp_secret.present?
+    totp_secret = user.totp_secret
+
+    # Sign in with TOTP
+    post signin_path, params: { email_address: "totp_secret_test@example.com", password: "password123" }
+    assert_redirected_to totp_verification_path
+
+    # Complete TOTP verification
+    totp = ROTP::TOTP.new(user.totp_secret)
+    valid_code = totp.now
+    post totp_verification_path, params: { code: valid_code }
+    assert_response :redirect
+
+    # The TOTP secret should never be exposed in the response body or headers
+    # This is enforced at the model level - the secret is a private attribute
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  test "TOTP secret is rotated when re-enabling" do
+    user = User.create!(email_address: "totp_rotate_test@example.com", password: "password123")
+
+    # Enable TOTP first time
+    user.enable_totp!
+    first_secret = user.totp_secret
+
+    # Disable and re-enable TOTP
+    user.update!(totp_secret: nil, backup_codes: nil)
+    user.enable_totp!
+    second_secret = user.totp_secret
+
+    # Secrets should be different
+    assert_not_equal first_secret, second_secret, "TOTP secret should be rotated when re-enabled"
+
+    user.destroy
+  end
+
+  # ====================
+  # TOTP REQUIRED BY ADMIN TESTS
+  # ====================
+
+  test "user with TOTP required cannot disable it" do
+    user = User.create!(email_address: "totp_required_test@example.com", password: "password123")
+    user.update!(totp_required: true)
+    user.enable_totp!
+
+    # Verify TOTP is enabled and required
+    assert user.totp_enabled?
+    assert user.totp_required?
+
+    # The disable_totp! method will clear the secret, but totp_required flag remains
+    # This is enforced in the controller - users can't disable TOTP if it's required
+    # The controller check is at app/controllers/totp_controller.rb:121-124
+
+    # Verify that totp_required flag prevents disabling
+    # (This is a controller-level check, not model-level)
+
+    user.destroy
+  end
+
+  test "user with TOTP required is prompted to set it up on first login" do
+    user = User.create!(email_address: "totp_setup_test@example.com", password: "password123")
+    user.update!(totp_required: true, totp_secret: nil)
+
+    # Sign in
+    post signin_path, params: { email_address: "totp_setup_test@example.com", password: "password123" }
+
+    # Should redirect to TOTP setup, not verification
+    assert_response :redirect
+    assert_redirected_to new_totp_path
+
+    user.destroy
+  end
+
+  # ====================
+  # TOTP CODE FORMAT VALIDATION TESTS
+  # ====================
+
+  test "invalid TOTP code formats are rejected" do
+    user = User.create!(email_address: "totp_format_test@example.com", password: "password123")
+
+    # Enable TOTP with backup codes
+    user.totp_secret = ROTP::Base32.random
+    user.send(:generate_backup_codes)
+    user.save!
+
+    # Set up pending TOTP session
+    post signin_path, params: { email_address: "totp_format_test@example.com", password: "password123" }
+    assert_redirected_to totp_verification_path
+
+    # Try invalid formats
+    invalid_codes = [
+      "12345",    # Too short
+      "1234567",  # Too long
+      "abcdef",   # Non-numeric (6 chars, won't match backup code format)
+      "12 3456",  # Contains space
+      ""          # Empty
+    ]
+
+    invalid_codes.each do |invalid_code|
+      post totp_verification_path, params: { code: invalid_code }
+      assert_response :redirect
+      assert_redirected_to totp_verification_path
+    end
+
+    user.destroy
+  end
+
+  # ====================
+  # TOTP RECOVERY FLOW TESTS
+  # ====================
+
+  test "user can sign in with backup code when TOTP device is lost" do
+    user = User.create!(email_address: "totp_recovery_test@example.com", password: "password123")
+
+    # Enable TOTP and generate backup codes
+    user.totp_secret = ROTP::Base32.random
+    backup_codes = user.send(:generate_backup_codes) # Call private method
+    user.save!
+
+    # Sign in
+    post signin_path, params: { email_address: "totp_recovery_test@example.com", password: "password123" }
+    assert_redirected_to totp_verification_path
+
+    # Use backup code instead of TOTP
+    post totp_verification_path, params: { code: backup_codes.first }
+
+    # Should successfully sign in
+    assert_response :redirect
+    assert_redirected_to root_path
+
+    user.sessions.delete_all
+    user.destroy
+  end
+end
--- a/test/fixtures/application_user_claims.yml
+++ b/test/fixtures/application_user_claims.yml
@@ -0,0 +1,11 @@
+# Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html
+
+kavita_alice_claims:
+  application: kavita_app
+  user: alice
+  custom_claims: { "kavita_groups": ["admin"], "library_access": "all" }
+
+abs_alice_claims:
+  application: audiobookshelf_app
+  user: alice
+  custom_claims: { "abs_groups": ["user"], "abs_permissions": { "canDownload": true, "canUpload": false } }
--- a/test/fixtures/applications.yml
+++ b/test/fixtures/applications.yml
@@ -13,6 +13,7 @@ kavita_app:
    https://kavita.example.com/signout-callback-oidc
  metadata: "{}"
  active: true
+  require_pkce: false

 another_app:
  name: Another App
@@ -24,3 +25,16 @@ another_app:
    https://app.example.com/auth/callback
  metadata: "{}"
  active: true
+  require_pkce: false
+
+audiobookshelf_app:
+  name: Audiobookshelf
+  slug: audiobookshelf
+  app_type: oidc
+  client_id: <%= SecureRandom.urlsafe_base64(32) %>
+  client_secret_digest: <%= BCrypt::Password.create(SecureRandom.urlsafe_base64(48)) %>
+  redirect_uris: |
+    https://abs.example.com/auth/openid/callback
+  metadata: "{}"
+  active: true
+  require_pkce: false
--- a/test/fixtures/groups.yml
+++ b/test/fixtures/groups.yml
@@ -1,5 +1,13 @@
 # Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html

+one:
+  name: Group One
+  description: First test group
+
+two:
+  name: Group Two
+  description: Second test group
+
 admin_group:
  name: Administrators
  description: System administrators with full access
--- a/test/fixtures/oidc_access_tokens.yml
+++ b/test/fixtures/oidc_access_tokens.yml
@@ -1,14 +1,16 @@
 # Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html

 one:
-  token: <%= SecureRandom.urlsafe_base64(32) %>
+  token_digest: <%= BCrypt::Password.create(SecureRandom.urlsafe_base64(48)) %>
+  token_prefix: <%= SecureRandom.urlsafe_base64(8)[0..7] %>
  application: kavita_app
  user: alice
  scope: "openid profile email"
  expires_at: 2025-12-31 23:59:59

 two:
-  token: <%= SecureRandom.urlsafe_base64(32) %>
+  token_digest: <%= BCrypt::Password.create(SecureRandom.urlsafe_base64(48)) %>
+  token_prefix: <%= SecureRandom.urlsafe_base64(8)[0..7] %>
  application: another_app
  user: bob
  scope: "openid profile email"
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -1,5 +1,17 @@
 <% password_digest = BCrypt::Password.create("password") %>

+one:
+  email_address: one@example.com
+  password_digest: <%= password_digest %>
+  admin: false
+  status: 0 # active
+
+two:
+  email_address: two@example.com
+  password_digest: <%= password_digest %>
+  admin: true
+  status: 0 # active
+
 alice:
  email_address: alice@example.com
  password_digest: <%= password_digest %>
--- a/test/integration/forward_auth_integration_test.rb
+++ b/test/integration/forward_auth_integration_test.rb
@@ -6,6 +6,15 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    @admin_user = users(:two)
    @group = groups(:one)
    @group2 = groups(:two)
+
+    # Create a forward_auth application for test.example.com
+    @test_app = Application.create!(
+      name: "Test App",
+      slug: "test-app",
+      app_type: "forward_auth",
+      domain_pattern: "test.example.com",
+      active: true
+    )
  end

  # Basic Authentication Flow Tests
@@ -14,52 +23,41 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }
    assert_response 302
    assert_match %r{/signin}, response.location
-    assert_equal "No session cookie", response.headers["X-Auth-Reason"]
+    assert_equal "No session cookie", response.headers["x-auth-reason"]

    # Step 2: Sign in
    post "/signin", params: { email_address: @user.email_address, password: "password" }
-    assert_redirected_to "/"
+    assert_response 302
+    # Signin now redirects back with fa_token parameter
+    assert_match(/\?fa_token=/, response.location)
    assert cookies[:session_id]

    # Step 3: Authenticated request should succeed
    get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }
    assert_response 200
-    assert_equal @user.email_address, response.headers["X-Remote-User"]
-  end
-
-  test "session persistence across multiple requests" do
-    # Sign in
-    post "/signin", params: { email_address: @user.email_address, password: "password" }
-    session_cookie = cookies[:session_id]
-    assert session_cookie
-
-    # Multiple requests should work with same session
-    3.times do |i|
-      get "/api/verify", headers: { "X-Forwarded-Host" => "app#{i}.example.com" }
-      assert_response 200
-      assert_equal @user.email_address, response.headers["X-Remote-User"]
-    end
+    assert_equal @user.email_address, response.headers["x-remote-user"]
  end

  test "session expiration handling" do
    # Sign in
    post "/signin", params: { email_address: @user.email_address, password: "password" }

-    # Manually expire the session
-    session = Session.find_by(id: cookies.signed[:session_id])
-    session.update!(created_at: 1.year.ago)
+    # Manually expire the session (get the most recent session for this user)
+    session = Session.where(user: @user).order(created_at: :desc).first
+    assert session, "No session found for user"
+    session.update!(expires_at: 1.hour.ago)

    # Request should fail and redirect to login
    get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }
    assert_response 302
-    assert_equal "Session expired", response.headers["X-Auth-Reason"]
+    assert_equal "Session expired", response.headers["x-auth-reason"]
  end

  # Domain and Rule Integration Tests
  test "different domain patterns with same session" do
    # Create test rules
-    wildcard_rule = ForwardAuthRule.create!(domain_pattern: "*.example.com", active: true)
-    exact_rule = ForwardAuthRule.create!(domain_pattern: "api.example.com", active: true)
+    wildcard_rule = Application.create!(name: "Wildcard App", slug: "wildcard-app", app_type: "forward_auth", domain_pattern: "*.example.com", active: true)
+    exact_rule = Application.create!(name: "Exact App", slug: "exact-app", app_type: "forward_auth", domain_pattern: "api.example.com", active: true)

    # Sign in
    post "/signin", params: { email_address: @user.email_address, password: "password" }
@@ -67,22 +65,22 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    # Test wildcard domain
    get "/api/verify", headers: { "X-Forwarded-Host" => "app.example.com" }
    assert_response 200
-    assert_equal @user.email_address, response.headers["X-Remote-User"]
+    assert_equal @user.email_address, response.headers["x-remote-user"]

    # Test exact domain
    get "/api/verify", headers: { "X-Forwarded-Host" => "api.example.com" }
    assert_response 200
-    assert_equal @user.email_address, response.headers["X-Remote-User"]
+    assert_equal @user.email_address, response.headers["x-remote-user"]

    # Test non-matching domain (should use defaults)
    get "/api/verify", headers: { "X-Forwarded-Host" => "other.example.com" }
    assert_response 200
-    assert_equal @user.email_address, response.headers["X-Remote-User"]
+    assert_equal @user.email_address, response.headers["x-remote-user"]
  end

  test "group-based access control integration" do
    # Create restricted rule
-    restricted_rule = ForwardAuthRule.create!(domain_pattern: "restricted.example.com", active: true)
+    restricted_rule = Application.create!(name: "Restricted App", slug: "restricted-app", app_type: "forward_auth", domain_pattern: "restricted.example.com", active: true)
    restricted_rule.allowed_groups << @group

    # Sign in user without group
@@ -91,7 +89,7 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    # Should be denied access
    get "/api/verify", headers: { "X-Forwarded-Host" => "restricted.example.com" }
    assert_response 403
-    assert_match %r{permission to access this domain}, response.headers["X-Auth-Reason"]
+    assert_match %r{permission to access this domain}, response.headers["x-auth-reason"]

    # Add user to group
    @user.groups << @group
@@ -99,19 +97,21 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    # Should now be allowed
    get "/api/verify", headers: { "X-Forwarded-Host" => "restricted.example.com" }
    assert_response 200
-    assert_equal @user.email_address, response.headers["X-Remote-User"]
+    assert_equal @user.email_address, response.headers["x-remote-user"]
  end

  # Header Configuration Integration Tests
  test "different header configurations with same user" do
-    # Create rules with different header configs
-    default_rule = ForwardAuthRule.create!(domain_pattern: "default.example.com", active: true)
-    custom_rule = ForwardAuthRule.create!(
+    # Create applications with different configs
+    default_rule = Application.create!(name: "Default App", slug: "default-app", app_type: "forward_auth", domain_pattern: "default.example.com", active: true)
+    custom_rule = Application.create!(
+      name: "Custom App", slug: "custom-app", app_type: "forward_auth",
      domain_pattern: "custom.example.com",
      active: true,
      headers_config: { user: "X-WEBAUTH-USER", groups: "X-WEBAUTH-ROLES" }
    )
-    no_headers_rule = ForwardAuthRule.create!(
+    no_headers_rule = Application.create!(
+      name: "No Headers App", slug: "no-headers-app", app_type: "forward_auth",
      domain_pattern: "noheaders.example.com",
      active: true,
      headers_config: { user: "", email: "", name: "", groups: "", admin: "" }
@@ -127,58 +127,61 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    # Test default headers
    get "/api/verify", headers: { "X-Forwarded-Host" => "default.example.com" }
    assert_response 200
-    assert_equal "X-Remote-User", response.headers.keys.find { |k| k.include?("User") }
-    assert_equal "X-Remote-Groups", response.headers.keys.find { |k| k.include?("Groups") }
+    # Rails normalizes header keys to lowercase
+    assert_equal @user.email_address, response.headers["x-remote-user"]
+    assert response.headers.key?("x-remote-groups")
+    assert_equal "Group Two,Group One", response.headers["x-remote-groups"]

    # Test custom headers
    get "/api/verify", headers: { "X-Forwarded-Host" => "custom.example.com" }
    assert_response 200
-    assert_equal "X-WEBAUTH-USER", response.headers.keys.find { |k| k.include?("USER") }
-    assert_equal "X-WEBAUTH-ROLES", response.headers.keys.find { |k| k.include?("ROLES") }
+    # Custom headers are also normalized to lowercase
+    assert_equal @user.email_address, response.headers["x-webauth-user"]
+    assert response.headers.key?("x-webauth-roles")
+    assert_equal "Group Two,Group One", response.headers["x-webauth-roles"]

    # Test no headers
    get "/api/verify", headers: { "X-Forwarded-Host" => "noheaders.example.com" }
    assert_response 200
-    auth_headers = response.headers.select { |k, v| k.match?(/^(X-|Remote-)/i) }
+    # Check that no auth-related headers are present (excluding security headers)
+    auth_headers = response.headers.select { |k, v| k.match?(/^x-remote-|^x-webauth-|^x-admin-/i) }
    assert_empty auth_headers
  end

  # Redirect URL Integration Tests
-  test "redirect URL preserves original request information" do
-    # Test with various redirect parameters
-    test_cases = [
-      { rd: "https://app.example.com/", rm: "GET" },
-      { rd: "https://grafana.example.com/dashboard", rm: "POST" },
-      { rd: "https://metube.example.com/videos", rm: "PUT" }
-    ]
-
-    test_cases.each do |params|
-      get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }, params: params
+  test "unauthenticated request redirects to signin with parameters" do
+    # Test that unauthenticated requests redirect to signin with rd and rm parameters
+    get "/api/verify", headers: {
+      "X-Forwarded-Host" => "grafana.example.com"
+    }, params: {
+      rd: "https://grafana.example.com/dashboard",
+      rm: "GET"
+    }

    assert_response 302
    location = response.location

-      # Should contain the original redirect URL
-      assert_includes location, params[:rd]
-      assert_includes location, params[:rm]
+    # Should redirect to signin with parameters (rd contains the original URL)
    assert_includes location, "/signin"
-    end
+    assert_includes location, "rd="
+    assert_includes location, "rm=GET"
+    # The rd parameter should contain the original grafana.example.com URL
+    assert_includes location, "grafana.example.com"
  end

  test "return URL functionality after authentication" do
    # Initial request should set return URL
    get "/api/verify", headers: {
-      "X-Forwarded-Host" => "test.example.com",
+      "X-Forwarded-Host" => "app.example.com",
      "X-Forwarded-Uri" => "/admin"
    }, params: { rd: "https://app.example.com/admin" }

    assert_response 302
    location = response.location

-    # Extract return URL from location
-    assert_match /rd=([^&]+)/, location
-    return_url = CGI.unescape($1)
-    assert_equal "https://app.example.com/admin", return_url
+    # Should contain the redirect URL parameter
+    assert_includes location, "rd="
+    assert_includes location, CGI.escape("https://app.example.com/admin")

    # Store session return URL
    return_to_after_authenticating = session[:return_to_after_authenticating]
@@ -191,7 +194,8 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    admin_user = users(:two)

    # Create restricted rule
-    admin_rule = ForwardAuthRule.create!(
+    admin_rule = Application.create!(
+      name: "Admin App", slug: "admin-app", app_type: "forward_auth",
      domain_pattern: "admin.example.com",
      active: true,
      headers_config: { user: "X-Admin-User", admin: "X-Admin-Flag" }
@@ -201,7 +205,7 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    post "/signin", params: { email_address: regular_user.email_address, password: "password" }
    get "/api/verify", headers: { "X-Forwarded-Host" => "admin.example.com" }
    assert_response 200
-    assert_equal regular_user.email_address, response.headers["X-Admin-User"]
+    assert_equal regular_user.email_address, response.headers["x-admin-user"]

    # Sign out
    delete "/session"
@@ -210,113 +214,36 @@ class ForwardAuthIntegrationTest < ActionDispatch::IntegrationTest
    post "/signin", params: { email_address: admin_user.email_address, password: "password" }
    get "/api/verify", headers: { "X-Forwarded-Host" => "admin.example.com" }
    assert_response 200
-    assert_equal admin_user.email_address, response.headers["X-Admin-User"]
-    assert_equal "true", response.headers["X-Admin-Flag"]
+    assert_equal admin_user.email_address, response.headers["x-admin-user"]
+    assert_equal "true", response.headers["x-admin-flag"]
  end

  # Security Integration Tests
  test "session hijacking prevention" do
    # User A signs in
    post "/signin", params: { email_address: @user.email_address, password: "password" }
-    user_a_session = cookies[:session_id]

-    # User B signs in
-    delete "/session"
+    # Verify User A can access protected resources
+    get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }
+    assert_response 200
+    assert_equal @user.email_address, response.headers["x-remote-user"]
+    user_a_session_id = Session.where(user: @user).last.id
+
+    # Reset integration test session (but keep User A's session in database)
+    reset!
+
+    # User B signs in (creates a new session)
    post "/signin", params: { email_address: @admin_user.email_address, password: "password" }
-    user_b_session = cookies[:session_id]

-    # User A's session should still work
-    get "/api/verify", headers: {
-      "X-Forwarded-Host" => "test.example.com",
-      "Cookie" => "_clinch_session_id=#{user_a_session}"
-    }
+    # Verify User B can access protected resources
+    get "/api/verify", headers: { "X-Forwarded-Host" => "test.example.com" }
    assert_response 200
-    assert_equal @user.email_address, response.headers["X-Remote-User"]
+    assert_equal @admin_user.email_address, response.headers["x-remote-user"]
+    user_b_session_id = Session.where(user: @admin_user).last.id

-    # User B's session should work
-    get "/api/verify", headers: {
-      "X-Forwarded-Host" => "test.example.com",
-      "Cookie" => "_clinch_session_id=#{user_b_session}"
-    }
-    assert_response 200
-    assert_equal @admin_user.email_address, response.headers["X-Remote-User"]
+    # Verify both sessions still exist in the database
+    assert Session.exists?(user_a_session_id), "User A's session should still exist"
+    assert Session.exists?(user_b_session_id), "User B's session should still exist"
  end

-  test "concurrent requests with same session" do
-    # Sign in
-    post "/signin", params: { email_address: @user.email_address, password: "password" }
-    session_cookie = cookies[:session_id]
-
-    # Simulate concurrent requests
-    threads = []
-    results = []
-
-    5.times do |i|
-      threads << Thread.new do
-        # Create a new integration test instance for this thread
-        test_instance = self.class.new
-        test_instance.setup_controller_request_and_response
-
-        test_instance.get "/api/verify", headers: {
-          "X-Forwarded-Host" => "app#{i}.example.com",
-          "Cookie" => "_clinch_session_id=#{session_cookie}"
-        }
-
-        results << {
-          thread_id: i,
-          status: test_instance.response.status,
-          user: test_instance.response.headers["X-Remote-User"]
-        }
-      end
-    end
-
-    threads.each(&:join)
-
-    # All requests should succeed
-    results.each do |result|
-      assert_equal 200, result[:status], "Thread #{result[:thread_id]} failed"
-      assert_equal @user.email_address, result[:user], "Thread #{result[:thread_id]} has wrong user"
-    end
-  end
-
-  # Performance Integration Tests
-  test "response times are reasonable" do
-    # Sign in
-    post "/signin", params: { email_address: @user.email_address, password: "password" }
-
-    # Test multiple requests
-    start_time = Time.current
-
-    10.times do |i|
-      get "/api/verify", headers: { "X-Forwarded-Host" => "app#{i}.example.com" }
-      assert_response 200
-    end
-
-    end_time = Time.current
-    total_time = end_time - start_time
-    average_time = total_time / 10
-
-    # Each request should take less than 100ms on average
-    assert average_time < 0.1, "Average response time #{average_time}s is too slow"
-  end
-
-  # Error Handling Integration Tests
-  test "graceful handling of malformed headers" do
-    # Sign in
-    post "/signin", params: { email_address: @user.email_address, password: "password" }
-
-    # Test various malformed header combinations
-    test_cases = [
-      { "X-Forwarded-Host" => nil },
-      { "X-Forwarded-Host" => "" },
-      { "X-Forwarded-Host" => "   " },
-      { "Host" => nil },
-      { "Host" => "" }
-    ]
-
-    test_cases.each_with_index do |headers, i|
-      get "/api/verify", headers: headers
-      assert_response 200, "Failed on test case #{i}: #{headers.inspect}"
-    end
-  end
 end
--- a/test/integration/invitation_flow_test.rb
+++ b/test/integration/invitation_flow_test.rb
@@ -49,7 +49,9 @@ class InvitationFlowTest < ActionDispatch::IntegrationTest
      email_address: "newuser@example.com",
      password: "SecurePassword123!"
    }
-    assert_redirected_to root_path
+    # Redirect may include fa_token parameter for first-time authentication
+    assert_response :redirect
+    assert_match %r{^http://www\.example\.com/}, response.location
    assert cookies[:session_id]
  end

--- a/test/integration/session_security_test.rb
+++ b/test/integration/session_security_test.rb
@@ -0,0 +1,307 @@
+require "test_helper"
+
+class SessionSecurityTest < ActionDispatch::IntegrationTest
+  # ====================
+  # SESSION TIMEOUT TESTS
+  # ====================
+
+  test "session expires after inactivity" do
+    user = User.create!(email_address: "session_test@example.com", password: "password123")
+
+    # Sign in
+    post signin_path, params: { email_address: "session_test@example.com", password: "password123" }
+    assert_response :redirect
+    follow_redirect!
+    assert_response :success
+
+    # Create a session that expires in 1 hour
+    session_record = user.sessions.create!(
+      ip_address: "127.0.0.1",
+      user_agent: "TestAgent",
+      last_activity_at: Time.current,
+      expires_at: 1.hour.from_now
+    )
+
+    # Session should be active
+    assert session_record.active?
+
+    # Simulate session expiration by traveling past the expiry time
+    travel 2.hours do
+      session_record.reload
+      assert_not session_record.active?
+    end
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  test "active sessions are tracked correctly" do
+    user = User.create!(email_address: "multi_session_test@example.com", password: "password123")
+
+    # Create multiple sessions
+    session1 = user.sessions.create!(
+      ip_address: "192.168.1.1",
+      user_agent: "Mozilla/5.0 (Windows)",
+      device_name: "Windows PC",
+      last_activity_at: 10.minutes.ago
+    )
+
+    session2 = user.sessions.create!(
+      ip_address: "192.168.1.2",
+      user_agent: "Mozilla/5.0 (iPhone)",
+      device_name: "iPhone",
+      last_activity_at: 5.minutes.ago
+    )
+
+    # Check that both sessions are active
+    assert_equal 2, user.sessions.active.count
+
+    # Revoke one session
+    session2.update!(expires_at: 1.minute.ago)
+
+    # Only one session should remain active
+    assert_equal 1, user.sessions.active.count
+    assert_equal session1.id, user.sessions.active.first.id
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  # ====================
+  # SESSION FIXATION PREVENTION TESTS
+  # ====================
+
+  test "session_id changes after authentication" do
+    user = User.create!(email_address: "session_fixation_test@example.com", password: "password123")
+
+    # Sign in creates a new session
+    post signin_path, params: { email_address: "session_fixation_test@example.com", password: "password123" }
+    assert_response :redirect
+
+    # User should be authenticated after sign in
+    assert_redirected_to root_path
+
+    user.destroy
+  end
+
+  # ====================
+  # CONCURRENT SESSION HANDLING TESTS
+  # ====================
+
+  test "user can have multiple concurrent sessions" do
+    user = User.create!(email_address: "concurrent_session_test@example.com", password: "password123")
+
+    # Create multiple sessions from different devices
+    session1 = user.sessions.create!(
+      ip_address: "192.168.1.1",
+      user_agent: "Mozilla/5.0 (Windows)",
+      device_name: "Windows PC",
+      last_activity_at: Time.current
+    )
+
+    session2 = user.sessions.create!(
+      ip_address: "192.168.1.2",
+      user_agent: "Mozilla/5.0 (iPhone)",
+      device_name: "iPhone",
+      last_activity_at: Time.current
+    )
+
+    session3 = user.sessions.create!(
+      ip_address: "192.168.1.3",
+      user_agent: "Mozilla/5.0 (Macintosh)",
+      device_name: "MacBook",
+      last_activity_at: Time.current
+    )
+
+    # All three sessions should be active
+    assert_equal 3, user.sessions.active.count
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  test "revoking one session does not affect other sessions" do
+    user = User.create!(email_address: "revoke_session_test@example.com", password: "password123")
+
+    # Create two sessions
+    session1 = user.sessions.create!(
+      ip_address: "192.168.1.1",
+      user_agent: "Mozilla/5.0 (Windows)",
+      device_name: "Windows PC",
+      last_activity_at: Time.current
+    )
+
+    session2 = user.sessions.create!(
+      ip_address: "192.168.1.2",
+      user_agent: "Mozilla/5.0 (iPhone)",
+      device_name: "iPhone",
+      last_activity_at: Time.current
+    )
+
+    # Revoke session1
+    session1.update!(expires_at: 1.minute.ago)
+
+    # Session2 should still be active
+    assert_equal 1, user.sessions.active.count
+    assert_equal session2.id, user.sessions.active.first.id
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  # ====================
+  # LOGOUT INVALIDATES SESSIONS TESTS
+  # ====================
+
+  test "logout invalidates current session" do
+    user = User.create!(email_address: "logout_test@example.com", password: "password123")
+
+    # Create multiple sessions
+    session1 = user.sessions.create!(
+      ip_address: "192.168.1.1",
+      user_agent: "Mozilla/5.0 (Windows)",
+      device_name: "Windows PC",
+      last_activity_at: Time.current
+    )
+
+    session2 = user.sessions.create!(
+      ip_address: "192.168.1.2",
+      user_agent: "Mozilla/5.0 (iPhone)",
+      device_name: "iPhone",
+      last_activity_at: Time.current
+    )
+
+    # Sign in (creates a new session via the sign-in flow)
+    post signin_path, params: { email_address: "logout_test@example.com", password: "password123" }
+    assert_response :redirect
+
+    # Should have 3 sessions now
+    assert_equal 3, user.sessions.count
+
+    # Sign out (only terminates the current session)
+    delete signout_path
+    assert_response :redirect
+    follow_redirect!
+    assert_response :success
+
+    # The 2 manually created sessions should still be active
+    # The sign-in session was terminated
+    assert_equal 2, user.sessions.active.count
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  test "logout sends backchannel logout notifications" do
+    user = User.create!(email_address: "logout_notification_test@example.com", password: "password123")
+    application = Application.create!(
+      name: "Logout Test App",
+      slug: "logout-test-app",
+      app_type: "oidc",
+      redirect_uris: ["http://localhost:4000/callback"].to_json,
+      backchannel_logout_uri: "http://localhost:4000/logout",
+      active: true
+    )
+
+    # Create consent with backchannel logout enabled
+    consent = OidcUserConsent.create!(
+      user: user,
+      application: application,
+      scopes_granted: "openid profile",
+      sid: "test-session-id-123"
+    )
+
+    # Sign in
+    post signin_path, params: { email_address: "logout_notification_test@example.com", password: "password123" }
+    assert_response :redirect
+
+    # Sign out
+    assert_enqueued_jobs 1 do
+      delete signout_path
+      assert_response :redirect
+    end
+
+    # Verify backchannel logout job was enqueued
+    assert_equal BackchannelLogoutJob, ActiveJob::Base.queue_adapter.enqueued_jobs.first[:job]
+
+    user.sessions.delete_all
+    user.destroy
+    application.destroy
+  end
+
+  # ====================
+  # SESSION HIJACKING PREVENTION TESTS
+  # ====================
+
+  test "session includes IP address and user agent tracking" do
+    user = User.create!(email_address: "hijacking_test@example.com", password: "password123")
+
+    # Sign in
+    post signin_path, params: { email_address: "hijacking_test@example.com", password: "password123" },
+      headers: { "HTTP_USER_AGENT" => "TestBrowser/1.0" }
+    assert_response :redirect
+
+    # Check that session includes IP and user agent
+    session = user.sessions.active.first
+    assert_not_nil session.ip_address
+    assert_not_nil session.user_agent
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  test "session activity is tracked" do
+    user = User.create!(email_address: "activity_test@example.com", password: "password123")
+
+    # Create session
+    session = user.sessions.create!(
+      ip_address: "192.168.1.1",
+      user_agent: "Mozilla/5.0",
+      device_name: "Test Device",
+      last_activity_at: 1.hour.ago
+    )
+
+    # Simulate activity update
+    session.update!(last_activity_at: Time.current)
+
+    # Session should still be active
+    assert session.active?
+
+    user.sessions.delete_all
+    user.destroy
+  end
+
+  # ====================
+  # FORWARD AUTH SESSION TESTS
+  # ====================
+
+  test "forward auth validates session correctly" do
+    user = User.create!(email_address: "forward_auth_test@example.com", password: "password123")
+    application = Application.create!(
+      name: "Forward Auth Test",
+      slug: "forward-auth-test-#{SecureRandom.hex(4)}",
+      app_type: "forward_auth",
+      domain_pattern: "test.example.com",
+      redirect_uris: ["https://test.example.com"].to_json,
+      active: true
+    )
+
+    # Create session
+    user_session = user.sessions.create!(
+      ip_address: "192.168.1.1",
+      user_agent: "Mozilla/5.0",
+      last_activity_at: Time.current
+    )
+
+    # Test forward auth endpoint with valid session
+    get api_verify_path(rd: "https://test.example.com/protected"),
+      headers: { cookie: "_session_id=#{user_session.id}" }
+
+    # Should accept the request and redirect back
+    assert_response :redirect
+
+    user.sessions.delete_all
+    user.destroy
+    application.destroy
+  end
+end
--- a/test/jobs/application_job_test.rb
+++ b/test/jobs/application_job_test.rb
@@ -37,11 +37,14 @@ class ApplicationJobTest < ActiveJob::TestCase
    end

    assert_enqueued_jobs 1 do
-      test_job.perform_later("arg1", "arg2", { key: "value" })
+      test_job.perform_later("arg1", "arg2", { "key" => "value" })
    end

-    # Job class name may be nil in test environment, focus on args
-    assert_equal ["arg1", "arg2", { key: "value" }], enqueued_jobs.last[:args]
+    # ActiveJob serializes all hash keys as strings
+    args = enqueued_jobs.last[:args]
+    assert_equal "arg1", args[0]
+    assert_equal "arg2", args[1]
+    assert_equal "value", args[2]["key"]
  end

  test "should have default queue configuration" do
--- a/test/jobs/invitations_mailer_test.rb
+++ b/test/jobs/invitations_mailer_test.rb
@@ -25,8 +25,8 @@ class InvitationsMailerTest < ActionMailer::TestCase

    assert_equal "You're invited to join Clinch", email.subject
    assert_equal [@user.email_address], email.to
-    assert_equal [], email.cc
-    assert_equal [], email.bcc
+    assert_equal [], email.cc || []
+    assert_equal [], email.bcc || []
    # From address is configured in ApplicationMailer
    assert_not_nil email.from
    assert email.from.is_a?(Array)
@@ -107,17 +107,15 @@ class InvitationsMailerTest < ActionMailer::TestCase
  end

  test "should have proper email headers" do
-    email = @invitation_mail
+    # Deliver the email first to ensure headers are set
+    email = InvitationsMailer.invite_user(@user).deliver_now

-    # Test common email headers
+    # Test common email headers (message_id is set on delivery)
    assert_not_nil email.message_id
    assert_not_nil email.date

-    # Test content-type
-    if email.html_part
-      assert_includes email.content_type, "text/html"
-    elsif email.text_part
-      assert_includes email.content_type, "text/plain"
-    end
+    # Test content-type - multipart emails contain both text and html parts
+    assert_includes email.content_type, "multipart"
+    assert email.html_part || email.text_part, "Should have html or text part"
  end
 end
--- a/test/jobs/oidc_token_cleanup_job_test.rb
+++ b/test/jobs/oidc_token_cleanup_job_test.rb
@@ -0,0 +1,7 @@
+require "test_helper"
+
+class OidcTokenCleanupJobTest < ActiveJob::TestCase
+  # test "the truth" do
+  #   assert true
+  # end
+end
--- a/test/jobs/passwords_mailer_test.rb
+++ b/test/jobs/passwords_mailer_test.rb
@@ -25,8 +25,8 @@ class PasswordsMailerTest < ActionMailer::TestCase

    assert_equal "Reset your password", email.subject
    assert_equal [@user.email_address], email.to
-    assert_equal [], email.cc
-    assert_equal [], email.bcc
+    assert_equal [], email.cc || []
+    assert_equal [], email.bcc || []
    # From address is configured in ApplicationMailer
    assert_not_nil email.from
    assert email.from.is_a?(Array)
@@ -40,9 +40,6 @@ class PasswordsMailerTest < ActionMailer::TestCase
    email = PasswordsMailer.reset(@user)
    email_body = email.body.encoded

-    # Should include user's email address
-    assert_includes email_body, @user.email_address
-
    # Should include reset link structure
    assert_includes email_body, "reset"
    assert_includes email_body, "password"
@@ -53,6 +50,8 @@ class PasswordsMailerTest < ActionMailer::TestCase
    # Should include reset-related text
    assert_includes email_text, "reset"
    assert_includes email_text, "password"
+    # Should include a URL (the reset link)
+    assert_includes email_text, "http"
  end

  test "should handle users with different statuses" do
@@ -149,23 +148,27 @@ class PasswordsMailerTest < ActionMailer::TestCase
  end

  test "should have proper email headers and security" do
-    email = @reset_mail
+    email = PasswordsMailer.reset(@user)
+    email.deliver_now

    # Test common email headers
    assert_not_nil email.message_id
    assert_not_nil email.date

-    # Test content-type
-    if email.html_part
+    # Test content-type (can be multipart, text/html, or text/plain)
+    if email.html_part && email.text_part
+      assert_includes email.content_type, "multipart/alternative"
+    elsif email.html_part
      assert_includes email.content_type, "text/html"
    elsif email.text_part
      assert_includes email.content_type, "text/plain"
    end

-    # Should not include sensitive data in headers
-    email.header.each do |key, value|
-      refute_includes value.to_s.downcase, "password"
-      refute_includes value.to_s.downcase, "token"
+    # Should not include sensitive data in headers (except Subject which legitimately mentions password)
+    email.header.fields.each do |field|
+      next if field.name =~ /^subject$/i
+      # Check for actual tokens (not just the word "token" which is common in emails)
+      refute_includes field.value.to_s.downcase, "password"
    end
  end

--- a/test/models/application_user_claim_test.rb
+++ b/test/models/application_user_claim_test.rb
@@ -0,0 +1,78 @@
+require "test_helper"
+
+class ApplicationUserClaimTest < ActiveSupport::TestCase
+  def setup
+    @user = users(:bob)
+    @application = applications(:another_app)
+  end
+
+  test "should create valid application user claim" do
+    claim = ApplicationUserClaim.new(
+      user: @user,
+      application: @application,
+      custom_claims: { "role": "admin" }
+    )
+    assert claim.valid?
+    assert claim.save
+  end
+
+  test "should enforce uniqueness of user per application" do
+    ApplicationUserClaim.create!(
+      user: @user,
+      application: @application,
+      custom_claims: { "role": "admin" }
+    )
+
+    duplicate = ApplicationUserClaim.new(
+      user: @user,
+      application: @application,
+      custom_claims: { "role": "user" }
+    )
+
+    assert_not duplicate.valid?
+    assert_includes duplicate.errors[:user_id], "has already been taken"
+  end
+
+  test "parsed_custom_claims returns hash" do
+    claim = ApplicationUserClaim.new(
+      user: @user,
+      application: @application,
+      custom_claims: { "role": "admin", "level": 5 }
+    )
+
+    parsed = claim.parsed_custom_claims
+    assert_equal "admin", parsed["role"]
+    assert_equal 5, parsed["level"]
+  end
+
+  test "parsed_custom_claims returns empty hash when nil" do
+    claim = ApplicationUserClaim.new(
+      user: @user,
+      application: @application,
+      custom_claims: nil
+    )
+
+    assert_equal({}, claim.parsed_custom_claims)
+  end
+
+  test "should not allow reserved OIDC claim names" do
+    claim = ApplicationUserClaim.new(
+      user: @user,
+      application: @application,
+      custom_claims: { "groups": ["admin"], "role": "user" }
+    )
+
+    assert_not claim.valid?
+    assert_includes claim.errors[:custom_claims], "cannot override reserved OIDC claims: groups"
+  end
+
+  test "should allow non-reserved claim names" do
+    claim = ApplicationUserClaim.new(
+      user: @user,
+      application: @application,
+      custom_claims: { "kavita_groups": ["admin"], "role": "user" }
+    )
+
+    assert claim.valid?
+  end
+end
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Dan Milne	ed7ceedef5	Include the hash of the access token in the JWT / ID Token under the key at_hash as per the requirements. Update the discovery endpoint to describe subject_type as 'pairwise', rather than 'public', since we do pairwise subject ids. Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-31 14:45:38 +11:00
Dan Milne	40815d3576	Use SolidQueue in production. Use the find_by_token method, rather than iterating over refresh tokens, as we already fixed for tokens	2025-12-31 14:32:34 +11:00
Dan Milne	a17c08c890	Improve the README	2025-12-31 14:31:53 +11:00
Dan Milne	4f31fadc6c	Improve the README and remove incorrect claims. Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-31 12:17:15 +11:00
Dan Milne	29c0981a59	Improve readme and tests Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-31 11:56:09 +11:00
Dan Milne	9d402fcd92	Clean up and secure web_authn controller Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-31 11:44:11 +11:00
Dan Milne	9530c8284f	Version bump Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-31 10:35:27 +11:00
Dan Milne	bb5aa2e6d6	Add rails encryption for totp - allow configuration of encryption secrets from env, or derive them from SECRET_KEY_BASE. Don't leak email address via web_authn, rate limit web_authn, escape oidc state value, require password for changing email address, allow settings the hmac secret for token prefix generation	2025-12-31 10:33:56 +11:00
Dan Milne	cc7beba9de	PKCE is now default enabled. You can now create public / no-secret apps OIDC apps	2025-12-31 09:22:18 +11:00
Dan Milne	00eca6d8b2	Default deny forward_auth requests	2025-12-30 16:04:01 +11:00
Dan Milne	32235f9647	version bump Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-30 11:58:31 +11:00
Dan Milne	71d59e7367	Remove plain text token from everywhere Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-30 11:58:11 +11:00
Dan Milne	99c3ac905f	Add a token prefix column, generate the token_prefix and the token_digest, removing the plaintext token from use.	2025-12-30 09:45:16 +11:00
Dan Milne	0761c424c1	Fix tests. Remove tests which test rails functionality Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-30 00:18:19 +11:00
Dan Milne	2a32d75895	Fix tests - don't test standard rails features	2025-12-29 19:45:01 +11:00
Dan Milne	4c1df53fd5	Fix more tests Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-29 19:22:08 +11:00
Dan Milne	acab15ce30	Fix more tests	2025-12-29 18:48:41 +11:00
Dan Milne	0361bfe470	Fix forward_auth bugs - including disabled apps still working. Fix forward_auth tests Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-29 15:37:12 +11:00
Dan Milne	5b9d15584a	Add more rate limiting, and more restrictive headers	2025-12-29 13:29:14 +11:00
Dan Milne	898fd69a5d	Add permissions initializer and missing image paste controller Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-29 13:27:30 +11:00
Dan Milne	9cf01f7c7a	Bump versoin	2025-12-28 14:43:26 +11:00
Dan Milne	ab362aabac	Remove the rate limit for the forward auth system Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-12-28 14:40:53 +11:00
Dan Milne	283feea175	Update depenencies, bump versoin	2025-11-30 23:13:25 +11:00
Dan Milne	7af8624bf8	Handle empty backchannel logout urls Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-11-27 19:19:34 +11:00
Dan Milne	f8543f98cc	Add a subdirectory for active storage Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-11-27 19:12:09 +11:00
Dan Milne	6be23c2c37	Add backchannel logout, per application logout. Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-11-27 16:38:27 +11:00
Dan Milne	eb2d7379bf	Backchannel complete - improve oidc credential display	2025-11-27 11:52:25 +11:00
Dan Milne	67d86e5835	Add Icons for apps	2025-11-25 19:11:22 +11:00
Dan Milne	d6029556d3	Add OIDC fixes, add prefered_username, add application-user claims	2025-11-25 16:29:40 +11:00
Dan Milne	7796c38c08	Add pairwise SID with a UUIDv4, a significatant upgrade over User.id.to_s. Complete allowing admin to enforce TOTP per user Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-11-23 11:16:06 +11:00
Dan Milne	e882a4d6d1	More complete oidc Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-11-18 20:03:03 +11:00
Dan Milne	ab0085e9c9	More complete oidc	2025-11-18 20:02:45 +11:00
Dan Milne	1ee3302319	Improvements derived from rodauth-oauth	2025-11-12 22:17:55 +11:00
Dan Milne	67f28faaca	Improve some front end views. More descriptive error condition reporting. Updates to CLINCH_HOST for better WEBAUTHN	2025-11-12 16:24:05 +11:00
Dan Milne	33ad956508	Add test	2025-11-12 15:50:04 +11:00
Dan Milne	11ec753c68	Bump up the forward auth token ttl, fix leaking of error data Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-11-09 12:27:53 +11:00
Dan Milne	4df2eee4d9	Bug fix for domain names with empty string instead of null. Form errors and some security fixes Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-11-09 12:22:41 +11:00
Dan Milne	d9f11abbbf	Fixes for OIDC and HTML	2025-11-09 12:04:26 +11:00
Dan Milne	c92e69fa4a	Add PCKE	2025-11-09 11:54:45 +11:00
Dan Milne	038801f34b	Add pkce Some checks failed CI / scan_ruby (push) Has been cancelled Details CI / scan_js (push) Has been cancelled Details CI / lint (push) Has been cancelled Details CI / test (push) Has been cancelled Details CI / system-test (push) Has been cancelled Details	2025-11-09 10:21:29 +11:00