# Business Rules — Index

> Generado automáticamente. **No editar a mano**. Regenera con `pnpm br:generate`.

- Generado: `2026-06-09T07:56:35.978Z`
- Reglas totales: **7**
  - Activas: 7
  - Derogadas: 0
  - Propuestas: 0
- Archivos: 2

## Catálogo

| ID | Título | BCs | Agregados | Estado | Severidad | Last updated | Archivo |
| -- | ------ | --- | --------- | ------ | --------- | ------------ | ------- |
| `BR-OAUTH-AUTHCODE-001` | Código de autorización de un solo uso (consumo atómico) | o-auth | authorization-code | `active` | `blocking` | 2026-06-08 | [link](../../cliter/o-auth/business-rules/authorization-code.md) |
| `BR-OAUTH-AUTHCODE-002` | Expiración del código en ventana corta | o-auth | authorization-code | `active` | `blocking` | 2026-06-08 | [link](../../cliter/o-auth/business-rules/authorization-code.md) |
| `BR-OAUTH-AUTHCODE-003` | Binding exacto de clientId y redirect_uri en el canje | o-auth | authorization-code | `active` | `blocking` | 2026-06-08 | [link](../../cliter/o-auth/business-rules/authorization-code.md) |
| `BR-OAUTH-AUTHCODE-004` | Verificación PKCE S256 obligatoria en el canje | o-auth | authorization-code | `active` | `blocking` | 2026-06-08 | [link](../../cliter/o-auth/business-rules/authorization-code.md) |
| `BR-OAUTH-AUTHCODE-005` | `/authorize`: validación de petición y redirect_uri sin open-redirect | o-auth | authorization-code | `active` | `blocking` | 2026-06-08 | [link](../../cliter/o-auth/business-rules/authorization-code.md) |
| `BR-OAUTH-HUBSESSION-001` | El logout RP-initiated termina la sesión del hub | o-auth | hub-session | `active` | `blocking` | 2026-06-09 | [link](../../cliter/o-auth/business-rules/hub-session.md) |
| `BR-OAUTH-HUBSESSION-002` | Validación same-origin de `post_logout_redirect_uri` (anti open-redirect) | o-auth | hub-session | `active` | `blocking` | 2026-06-09 | [link](../../cliter/o-auth/business-rules/hub-session.md) |
