feat(ui): add secret regeneration page and client credentials flow for user apps by appleboy · Pull Request #121 · go-authgate/authgate

appleboy · 2026-03-21T09:35:40Z

Summary

Add dedicated UserAppSecret template for user-facing secret regeneration with proper title, security warning, and copy-to-clipboard button (previously reused the misleading "App Registered" page)
Handle GetClient error after regeneration with fallback to pre-loaded client
Add UserClientSecretPageProps type alias for self-describing template API
Enable Client Credentials Flow in user app form for confidential clients (previously admin-only)
Add EnableClientCredentialsFlow to UserUpdateClientRequest and update grant-type validation

Test plan

- Add user_app_secret.templ with proper title, security warning, and copy-to-clipboard support - Replace reuse of UserAppCreated template with dedicated UserAppSecret template in handler Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

codecov · 2026-03-21T09:37:48Z

Codecov Report

❌ Patch coverage is 29.41176% with 60 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/handlers/user_client.go	0.00%	37 Missing ⚠️
internal/core/client_type.go	0.00%	16 Missing ⚠️
internal/handlers/client.go	0.00%	4 Missing ⚠️
internal/services/client.go	86.36%	1 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

Copilot

Pull request overview

Adds a dedicated UI page for user-owned app client-secret regeneration so the post-regeneration experience matches the admin flow and avoids the misleading “App Registered”/pending-approval messaging.

Changes:

Introduces UserAppSecret templ page to display the regenerated secret with security warning and copy-to-clipboard affordance.
Updates RegenerateAppSecret handler to render the new template instead of reusing UserAppCreated.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
internal/templates/user_app_secret.templ	New dedicated secret-regeneration template for user apps (mirrors admin secret page UX).
internal/handlers/user_client.go	Switches regenerate-secret handler to render `UserAppSecret`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-21T09:39:01Z

 	templates.RenderTempl(
 		c,
 		http.StatusOK,
-		templates.UserAppCreated(templates.UserClientCreatedPageProps{
+		templates.UserAppSecret(templates.UserClientCreatedPageProps{
 			BaseProps:   templates.BaseProps{CSRFToken: middleware.GetCSRFToken(c)},


GetClient is called after regenerating the secret and its error is ignored; if it fails (and returns nil), clientToDisplay will produce nil and the template render will likely panic when dereferencing props.Client. Handle the error (or fall back to the already-loaded client) before rendering the response.

Copilot · 2026-03-21T09:39:02Z

@@ -0,0 +1,62 @@
+package templates
+
+templ UserAppSecret(props UserClientCreatedPageProps) {


The new UserAppSecret page uses UserClientCreatedPageProps, which is now misleading since it’s not only used for the post-create flow. Consider introducing a dedicated props type (e.g., UserClientSecretPageProps) or renaming the existing type to reflect both create and regenerate use cases to keep template APIs self-describing.

Suggested change

templ UserAppSecret(props UserClientCreatedPageProps) {

type UserClientSecretPageProps = UserClientCreatedPageProps

templ UserAppSecret(props UserClientSecretPageProps) {

- Handle GetClient error after regeneration with fallback to pre-loaded client - Add UserClientSecretPageProps type alias for self-describing template API Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Show Client Credentials Flow checkbox in user app form for confidential clients - Parse and pass EnableClientCredentialsFlow in CreateApp and UpdateApp handlers - Add EnableClientCredentialsFlow to UserUpdateClientRequest - Enforce confidential-only constraint in UserUpdateClient service method Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-21T09:58:53Z

+	enableClientCredentials := req.EnableClientCredentialsFlow &&
+		client.ClientType == ClientTypeConfidential
+	client.EnableClientCredentialsFlow = enableClientCredentials
+	client.GrantTypes = buildGrantTypes(
+		req.EnableDeviceFlow,
+		req.EnableAuthCodeFlow,
+		enableClientCredentials,
+	)


UserUpdateClient now supports EnableClientCredentialsFlow, but the function’s “at least one grant type” validation earlier still only considers device/auth-code. This makes it impossible to save/update a client configured with only Client Credentials (e.g., CC-only client created successfully will fail future updates). Update the validation to include req.EnableClientCredentialsFlow (and keep the confidential-only restriction) so it matches the grant-types rebuilding logic.

Copilot · 2026-03-21T09:58:53Z

+							ShowClientCredentials: true,
 							ScopePresetsOnly:      true,


This changes the user app form to expose Client Credentials Flow controls (ShowClientCredentials: true). That’s a functional behavior change (users can request/enable CC flow) and isn’t mentioned in the PR description/title, which frames this as only a dedicated secret-regeneration page. Either update the PR description to explicitly include this feature (and rationale/implications) or split it into a separate PR.

- Add EnableClientCredentialsFlow to the "at least one grant type" check in UserUpdateClient so CC-only confidential clients pass validation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

appleboy · 2026-03-21T12:09:58Z

@copilot review

Copilot · 2026-03-21T12:10:06Z

@appleboy I've opened a new pull request, #122, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-21T12:17:44Z

+	if !req.EnableDeviceFlow && !req.EnableAuthCodeFlow && !req.EnableClientCredentialsFlow {
 		return ErrAtLeastOneGrantRequired
 	}


UserUpdateClient validates ErrAtLeastOneGrantRequired using the raw request flags, but later forces Client Credentials off for public clients. A crafted request like client_type=public + enable_client_credentials_flow=true (and other flows false) will pass validation but end up with no enabled grants/empty GrantTypes. Consider either (a) validating client-type/grant compatibility up front and returning an error when CC is requested for public clients, or (b) re-checking the final computed enable flags (EnableDeviceFlow || EnableAuthCodeFlow || enableClientCredentials) before saving.

- Add ErrClientCredentialsRequireConfidential validation in UserUpdateClient before computing grant types, preventing public+CC-only from saving with empty grants Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Normalize client type early in UserUpdateClient to avoid inconsistency between validation and persistence - Add 3 tests: CC flow for confidential, CC rejected for public, CC-only confidential client Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

… admin UpdateClient - Add upfront ErrClientCredentialsRequireConfidential validation in CreateClient and admin UpdateClient, consistent with UserUpdateClient - Normalize client type early in all three paths Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Extract shared secret-regeneration card into SecretRegeneratedCard in client_shared.templ, parameterized by breadcrumb, labels, and paths - Refactor AdminClientSecret and UserAppSecret to use the shared component - Eliminates duplication and prevents long-term drift Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

… tests - Update ShowClientCredentials comment from "(admin only)" to "(confidential clients)" to reflect current behavior - Add CreateClient tests for CC flow: confidential success and public rejection Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-21T12:51:33Z

+			A new client secret has been successfully generated for "<strong>{ props.ClientName }</strong>"
+		</div>
+		<div class="warning-box warning-box-enhanced">
+			<div class="warning-icon">⚠</div>


The warning icon is purely decorative but will likely be announced by screen readers as a “warning sign” character. Consider adding aria-hidden="true" to the .warning-icon element (or alternatively role="img" + an explicit aria-label) so the accessible name comes from the nearby “Important Security Notice” text instead of the glyph.

Suggested change

<div class="warning-icon">⚠</div>

<div class="warning-icon" aria-hidden="true">⚠</div>

Copilot · 2026-03-21T12:51:33Z

 	IsEdit                bool
 	NameLabel             string // Display label: "App Name" (user) or "Client Name" (admin)
-	ShowClientCredentials bool   // Show Client Credentials Flow checkbox (admin only)
+	ShowClientCredentials bool   // Show Client Credentials Flow checkbox (confidential clients)


The field comment for ShowClientCredentials is a bit misleading: the checkbox is rendered based on this flag, but the confidential-vs-public restriction is enforced separately in the template JS (it’s still shown, just disabled for public). Suggest updating the comment to reflect that this flag controls rendering, not the client-type constraint itself.

Suggested change

ShowClientCredentials bool // Show Client Credentials Flow checkbox (confidential clients)

ShowClientCredentials bool // Control rendering of the Client Credentials Flow checkbox; client-type (confidential vs public) restrictions are enforced in the template JS (e.g. disabling for public clients)

…tials comment - Add aria-hidden="true" to decorative warning icon in SecretRegeneratedCard - Clarify ShowClientCredentials comment to reflect rendering vs JS enforcement Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Introduce core.ClientType with IsValid, OrDefault, and NormalizeClientType - Replace raw string constants with typed ClientType across services and handlers - Simplify normalize blocks to one-liner OrDefault calls - Remove redundant enableClientCredentials guard after early-return validation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot AI review requested due to automatic review settings March 21, 2026 09:35

Copilot started reviewing on behalf of appleboy March 21, 2026 09:36 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

appleboy and others added 2 commits March 21, 2026 17:41

appleboy requested a review from Copilot March 21, 2026 09:56

Copilot started reviewing on behalf of appleboy March 21, 2026 09:56 View session

chore: trigger copilot re-review

714c63e

Copilot AI reviewed Mar 21, 2026

View reviewed changes

appleboy changed the title ~~feat(ui): add dedicated secret regeneration page for user apps~~ feat(ui): add secret regeneration page and client credentials flow for user apps Mar 21, 2026

appleboy and others added 2 commits March 21, 2026 18:00

fix(service): include client credentials in user grant-type validation

4bad2c3

- Add EnableClientCredentialsFlow to the "at least one grant type" check in UserUpdateClient so CC-only confidential clients pass validation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: request copilot re-review after validation fix

b190001

Copilot AI mentioned this pull request Mar 21, 2026

[WIP] Add secret regeneration page and client credentials flow for user apps #122

Closed

appleboy requested a review from Copilot March 21, 2026 12:14

Copilot started reviewing on behalf of appleboy March 21, 2026 12:14 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

appleboy requested a review from Copilot March 21, 2026 12:20

Copilot started reviewing on behalf of appleboy March 21, 2026 12:20 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

Comment thread internal/services/client.go Outdated

Comment thread internal/services/client.go Outdated

appleboy requested a review from Copilot March 21, 2026 12:27

Copilot started reviewing on behalf of appleboy March 21, 2026 12:28 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

Comment thread internal/services/client.go

appleboy requested a review from Copilot March 21, 2026 12:34

Copilot started reviewing on behalf of appleboy March 21, 2026 12:34 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

Comment thread internal/templates/user_app_secret.templ Outdated

appleboy requested a review from Copilot March 21, 2026 12:40

Copilot started reviewing on behalf of appleboy March 21, 2026 12:41 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

Comment thread internal/templates/props.go

Comment thread internal/services/client.go Outdated

appleboy requested a review from Copilot March 21, 2026 12:47

Copilot started reviewing on behalf of appleboy March 21, 2026 12:47 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

appleboy requested a review from Copilot March 21, 2026 12:53

Copilot started reviewing on behalf of appleboy March 21, 2026 12:53 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

appleboy requested a review from Copilot March 21, 2026 14:56

Copilot started reviewing on behalf of appleboy March 21, 2026 14:57 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

appleboy merged commit dea632f into main Mar 21, 2026
20 of 21 checks passed

appleboy deleted the feat/user-app-regenerate-secret branch March 21, 2026 15:03

		@@ -0,0 +1,62 @@
		package templates

		templ UserAppSecret(props UserClientCreatedPageProps) {

-templ UserAppSecret(props UserClientCreatedPageProps) {
+type UserClientSecretPageProps = UserClientCreatedPageProps
+templ UserAppSecret(props UserClientSecretPageProps) {

	<div class="warning-icon">⚠</div>
	<div class="warning-icon" aria-hidden="true">⚠</div>

	ShowClientCredentials bool // Show Client Credentials Flow checkbox (confidential clients)
	ShowClientCredentials bool // Control rendering of the Client Credentials Flow checkbox; client-type (confidential vs public) restrictions are enforced in the template JS (e.g. disabling for public clients)

Uh oh!

Conversation

appleboy commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

codecov Bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

appleboy commented Mar 21, 2026

Uh oh!

Copilot AI commented Mar 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

appleboy commented Mar 21, 2026 •

edited

Loading

codecov Bot commented Mar 21, 2026 •

edited

Loading