Moved supported OAuth grantTypes, responseTypes and AuthMethods to configuration - #4296
Merged
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughOAuth features now use explicit configuration for enablement and supported policies. Initialization, grant handling, discovery metadata, application schemas, token validation, callback dispatch, and engine provider validation reflect those settings and handle disabled optional services safely. ChangesOAuth configuration and engine wiring
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant OAuthConfig
participant OAuthInit
participant GrantHandlers
participant Discovery
OAuthConfig->>OAuthInit: provide feature toggles and allowlists
OAuthInit->>GrantHandlers: initialize allowed grant handlers
OAuthInit->>Discovery: initialize enabled OAuth services
Discovery->>OAuthConfig: read enabled endpoints and supported values
Discovery->>GrantHandlers: inspect supported grant types
Discovery-->>OAuthConfig: return filtered metadata
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
backend/internal/oauth/oauth2/granthandlers/provider.go (1)
97-104: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winConsider validating
AllowedGrantTypesvalues at startup.A typo in
oauth.allowed_grant_typessilently disables that grant type (handler is never constructed,GetGrantHandlerjust returnsUnSupportedGrantTypeErrorat request time) with no startup-time signal. Validating configured values against the knownproviders.GrantTypeset during initialization would surface misconfiguration immediately instead of at first client request.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/internal/oauth/oauth2/granthandlers/provider.go` around lines 97 - 104, Validate each configured value in oauth.allowed_grant_types during OAuth provider initialization against the known providers.GrantType set, and fail startup with a clear configuration error when an unknown value is found. Reuse isGrantTypeAllowed for request-time filtering, but add the startup validation at the initialization path before grant handlers are constructed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/application/tools_test.go`:
- Around line 50-53: Update the test fixture in the relevant tools test to use
the approved product domain consistently: change the Hostname and PublicURL
values from thunder.io to thunderid.io while preserving the existing URL scheme
and other fields.
---
Nitpick comments:
In `@backend/internal/oauth/oauth2/granthandlers/provider.go`:
- Around line 97-104: Validate each configured value in
oauth.allowed_grant_types during OAuth provider initialization against the known
providers.GrantType set, and fail startup with a clear configuration error when
an unknown value is found. Reuse isGrantTypeAllowed for request-time filtering,
but add the startup validation at the initialization path before grant handlers
are constructed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 33ee9938-fe7d-4eed-912b-ca00f0a7fd6f
⛔ Files ignored due to path filters (5)
backend/tests/mocks/designprovidermock/DesignProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/i18nprovidermock/I18nProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/idpprovidermock/IDPProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/ouprovidermock/OrganizationUnitProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/resourceserverprovidermock/ResourceServerProvider_mock.gois excluded by!**/*_mock.go
📒 Files selected for processing (21)
backend/.mockery.public.ymlbackend/cmd/server/config/default.jsonbackend/cmd/server/servicemanager.gobackend/internal/application/tools.gobackend/internal/application/tools_test.gobackend/internal/oauth/init.gobackend/internal/oauth/oauth2/callback/callback.gobackend/internal/oauth/oauth2/callback/callback_test.gobackend/internal/oauth/oauth2/constants/constants.gobackend/internal/oauth/oauth2/discovery/discovery_test.gobackend/internal/oauth/oauth2/discovery/service.gobackend/internal/oauth/oauth2/granthandlers/provider.gobackend/internal/oauth/oauth2/granthandlers/provider_test.gobackend/internal/oauth/oauth2/granthandlers/refresh_token.gobackend/internal/oauth/oauth2/granthandlers/refresh_token_test.gobackend/internal/oauth/oauth2/tokenservice/validator.gobackend/internal/oauth/oauth2/tokenservice/validator_test.gobackend/pkg/thunderidengine/config/config.gobackend/pkg/thunderidengine/engine.gobackend/pkg/thunderidengine/engine_test.gobackend/tests/resources/deployment.yaml
anushasunkada
force-pushed
the
local_main
branch
from
July 23, 2026 12:27
88240b0 to
44b8fa9
Compare
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
backend/internal/application/tools_test.go (1)
51-53:⚠️ Potential issue | 🔴 CriticalUse the approved product name in the test fixture.
🔴 Incorrect product name:
thundermust beThunderID(or the appropriate template placeholder for the file type). Barethunder/Thunder/THUNDERis not an accepted short form of the product name.Replace
thunder.ioat Lines [51], [53], and [59] withthunderid.io.Proposed fix
- Hostname: "thunder.io", + Hostname: "thunderid.io", - PublicURL: "https://thunder.io", + PublicURL: "https://thunderid.io", - Issuer: "https://thunder.io", + Issuer: "https://thunderid.io",As per path instructions, bare
thunder/Thunder/THUNDERis not an accepted short form of the product name.Also applies to: 58-60
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/internal/application/tools_test.go` around lines 51 - 53, Update the test fixture fields in the relevant tools test, including Hostname and PublicURL, to use thunderid.io instead of thunder.io. Ensure all occurrences in the fixture are updated consistently while preserving the existing URL and port structure.Source: Path instructions
🧹 Nitpick comments (1)
docs/content/deployment/configuration.mdx (1)
455-459: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDocument all new OAuth feature toggles and empty-list behavior.
At Line [455], add rows for
oauth.token_revocation.enabledandoauth.logout.enabled, which are also introduced by this PR. At Line [459], document that an emptyoauth.allowed_grant_typeslist enables all available grant types; the allowlist also affects service initialization and discovery behavior.As per path instructions, documentation must cover all new configuration options and behavioral changes.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/deployment/configuration.mdx` around lines 455 - 459, The OAuth configuration table must document the new oauth.token_revocation.enabled and oauth.logout.enabled toggles. Update the oauth.allowed_grant_types description to state that an empty list enables all available grant types and that the allowlist affects service initialization and discovery behavior.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@backend/internal/application/tools_test.go`:
- Around line 51-53: Update the test fixture fields in the relevant tools test,
including Hostname and PublicURL, to use thunderid.io instead of thunder.io.
Ensure all occurrences in the fixture are updated consistently while preserving
the existing URL and port structure.
---
Nitpick comments:
In `@docs/content/deployment/configuration.mdx`:
- Around line 455-459: The OAuth configuration table must document the new
oauth.token_revocation.enabled and oauth.logout.enabled toggles. Update the
oauth.allowed_grant_types description to state that an empty list enables all
available grant types and that the allowlist affects service initialization and
discovery behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: bacd1ddb-8b49-497d-97e5-15f86236a04b
⛔ Files ignored due to path filters (5)
backend/tests/mocks/designprovidermock/DesignProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/i18nprovidermock/I18nProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/idpprovidermock/IDPProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/ouprovidermock/OrganizationUnitProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/resourceserverprovidermock/ResourceServerProvider_mock.gois excluded by!**/*_mock.go
📒 Files selected for processing (24)
backend/.mockery.public.ymlbackend/cmd/server/config/default.jsonbackend/cmd/server/servicemanager.gobackend/internal/application/tools.gobackend/internal/application/tools_test.gobackend/internal/oauth/init.gobackend/internal/oauth/oauth2/callback/callback.gobackend/internal/oauth/oauth2/callback/callback_test.gobackend/internal/oauth/oauth2/constants/constants.gobackend/internal/oauth/oauth2/discovery/discovery_test.gobackend/internal/oauth/oauth2/discovery/service.gobackend/internal/oauth/oauth2/granthandlers/provider.gobackend/internal/oauth/oauth2/granthandlers/provider_test.gobackend/internal/oauth/oauth2/granthandlers/refresh_token.gobackend/internal/oauth/oauth2/granthandlers/refresh_token_test.gobackend/internal/oauth/oauth2/tokenservice/validator.gobackend/internal/oauth/oauth2/tokenservice/validator_test.gobackend/pkg/thunderidengine/config/config.gobackend/pkg/thunderidengine/engine.gobackend/pkg/thunderidengine/engine_test.gobackend/tests/resources/deployment.yamldocs/content/deployment/configuration.mdxinstall/helm/conf/deployment.yamlinstall/helm/values.yaml
🚧 Files skipped from review as they are similar to previous changes (19)
- backend/internal/oauth/oauth2/granthandlers/refresh_token.go
- backend/tests/resources/deployment.yaml
- backend/cmd/server/servicemanager.go
- backend/internal/oauth/oauth2/granthandlers/provider_test.go
- backend/internal/oauth/init.go
- backend/internal/oauth/oauth2/callback/callback_test.go
- backend/pkg/thunderidengine/engine.go
- backend/internal/application/tools.go
- backend/internal/oauth/oauth2/tokenservice/validator.go
- backend/cmd/server/config/default.json
- backend/internal/oauth/oauth2/callback/callback.go
- backend/internal/oauth/oauth2/constants/constants.go
- backend/internal/oauth/oauth2/granthandlers/refresh_token_test.go
- backend/internal/oauth/oauth2/tokenservice/validator_test.go
- backend/internal/oauth/oauth2/granthandlers/provider.go
- backend/pkg/thunderidengine/config/config.go
- backend/pkg/thunderidengine/engine_test.go
- backend/internal/oauth/oauth2/discovery/service.go
- backend/internal/oauth/oauth2/discovery/discovery_test.go
anushasunkada
force-pushed
the
local_main
branch
from
July 23, 2026 12:47
44b8fa9 to
2815328
Compare
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
senthalan
reviewed
Jul 23, 2026
Member
|
I don't see the configurations like allowed_auth_methods, allowed_response_types and allowed_grant_types have been used to validate the oauth client details during the creation and update paths. @anushasunkada |
anushasunkada
force-pushed
the
local_main
branch
2 times, most recently
from
July 23, 2026 18:02
1647960 to
7c2882f
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/internal/inboundclient/service.go`:
- Around line 1070-1111: Add focused table-driven tests covering non-empty OAuth
allow-lists for validateWithAllowedGrantTypes, validateWithAllowedResponseTypes,
and validateAllowedTokenEndpointAuthMethod. Exercise both create and update
validation paths, asserting configured values are accepted and disabled grants,
response types, and auth methods are rejected, while preserving existing
empty-list coverage.
In `@install/helm/conf/deployment.yaml`:
- Around line 248-261: The OAuth configuration template currently renders only
DCR and method lists, omitting the new token revocation and logout feature
toggles. Update the relevant OAuth section in the deployment template to
serialize configuration.oauth.tokenRevocation.enabled and
configuration.oauth.logout.enabled alongside dcr.enabled, preserving the
existing Helm value structure and rendering style.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 6b5dad78-231d-4ba1-a235-e28dcc1146b9
⛔ Files ignored due to path filters (4)
backend/tests/mocks/designprovidermock/DesignProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/i18nprovidermock/I18nProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/ouprovidermock/OrganizationUnitProvider_mock.gois excluded by!**/*_mock.gobackend/tests/mocks/resourceserverprovidermock/ResourceServerProvider_mock.gois excluded by!**/*_mock.go
📒 Files selected for processing (29)
backend/.mockery.public.ymlbackend/cmd/server/config/default.jsonbackend/cmd/server/servicemanager.gobackend/internal/application/error_constants.gobackend/internal/application/service.gobackend/internal/application/service_test.gobackend/internal/application/tools.gobackend/internal/application/tools_test.gobackend/internal/inboundclient/service.gobackend/internal/oauth/init.gobackend/internal/oauth/oauth2/callback/callback.gobackend/internal/oauth/oauth2/callback/callback_test.gobackend/internal/oauth/oauth2/constants/constants.gobackend/internal/oauth/oauth2/discovery/discovery_test.gobackend/internal/oauth/oauth2/discovery/service.gobackend/internal/oauth/oauth2/granthandlers/provider.gobackend/internal/oauth/oauth2/granthandlers/provider_test.gobackend/internal/oauth/oauth2/granthandlers/refresh_token.gobackend/internal/oauth/oauth2/granthandlers/refresh_token_test.gobackend/internal/oauth/oauth2/tokenservice/validator.gobackend/internal/oauth/oauth2/tokenservice/validator_test.gobackend/internal/system/i18n/core/defaults.gobackend/pkg/thunderidengine/config/config.gobackend/pkg/thunderidengine/engine.gobackend/pkg/thunderidengine/engine_test.gobackend/tests/resources/deployment.yamldocs/content/deployment/configuration.mdxinstall/helm/conf/deployment.yamlinstall/helm/values.yaml
💤 Files with no reviewable changes (2)
- backend/internal/system/i18n/core/defaults.go
- backend/internal/application/error_constants.go
🚧 Files skipped from review as they are similar to previous changes (20)
- backend/tests/resources/deployment.yaml
- backend/internal/oauth/oauth2/granthandlers/refresh_token.go
- install/helm/values.yaml
- backend/internal/oauth/oauth2/callback/callback.go
- backend/internal/oauth/init.go
- backend/pkg/thunderidengine/engine.go
- backend/internal/oauth/oauth2/tokenservice/validator_test.go
- backend/internal/oauth/oauth2/constants/constants.go
- backend/internal/oauth/oauth2/tokenservice/validator.go
- backend/internal/application/tools_test.go
- backend/.mockery.public.yml
- docs/content/deployment/configuration.mdx
- backend/internal/application/tools.go
- backend/internal/oauth/oauth2/granthandlers/refresh_token_test.go
- backend/cmd/server/servicemanager.go
- backend/internal/oauth/oauth2/callback/callback_test.go
- backend/internal/oauth/oauth2/granthandlers/provider.go
- backend/pkg/thunderidengine/config/config.go
- backend/internal/oauth/oauth2/discovery/discovery_test.go
- backend/internal/oauth/oauth2/discovery/service.go
Comment on lines
+1070
to
+1111
| // validateAllowedGrantTypes rejects grant types not permitted by the deployment's configured | ||
| // oauth.allowed_grant_types allow-list. An empty allow-list permits all grant types. | ||
| func validateWithAllowedGrantTypes(grantTypes []string) error { | ||
| allowed := config.GetServerRuntime().Config.OAuth.AllowedGrantTypes | ||
| for _, grantType := range grantTypes { | ||
| if !providers.GrantType(grantType).IsValid() { | ||
| return ErrOAuthInvalidGrantType | ||
| } | ||
| if len(allowed) > 0 && !slices.Contains(allowed, grantType) { | ||
| return ErrOAuthInvalidGrantType | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // validateAllowedResponseTypes rejects response types not permitted by the deployment's configured | ||
| // oauth.allowed_response_types allow-list. An empty allow-list permits all response types. | ||
| func validateWithAllowedResponseTypes(responseTypes []string) error { | ||
| allowed := config.GetServerRuntime().Config.OAuth.AllowedResponseTypes | ||
| for _, responseType := range responseTypes { | ||
| if !providers.ResponseType(responseType).IsValid() { | ||
| return ErrOAuthInvalidResponseType | ||
| } | ||
| if len(allowed) > 0 && !slices.Contains(allowed, responseType) { | ||
| return ErrOAuthInvalidResponseType | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // validateAllowedTokenEndpointAuthMethod rejects a token endpoint auth method not permitted by the | ||
| // deployment's configured oauth.allowed_auth_methods allow-list. An empty allow-list permits all methods. | ||
| func validateWithAllowedTokenEndpointAuthMethod(method string) error { | ||
| if !providers.TokenEndpointAuthMethod(method).IsValid() { | ||
| return ErrOAuthInvalidTokenEndpointAuthMethod | ||
| } | ||
| allowed := config.GetServerRuntime().Config.OAuth.AllowedAuthMethods | ||
| if len(allowed) == 0 || slices.Contains(allowed, method) { | ||
| return nil | ||
| } | ||
| return ErrOAuthInvalidTokenEndpointAuthMethod | ||
| } |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Add configured allow-list enforcement tests.
The supplied tests only initialize OAuthConfig{} with empty lists, so they do not verify that each non-empty allow-list accepts allowed values and rejects disabled grants, response types, and auth methods. Add focused table-driven coverage for both create and update validation paths. As per coding guidelines, “Write tests for new features and bug fixes, targeting at least 80% coverage.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/internal/inboundclient/service.go` around lines 1070 - 1111, Add
focused table-driven tests covering non-empty OAuth allow-lists for
validateWithAllowedGrantTypes, validateWithAllowedResponseTypes, and
validateAllowedTokenEndpointAuthMethod. Exercise both create and update
validation paths, asserting configured values are accepted and disabled grants,
response types, and auth methods are rejected, while preserving existing
empty-list coverage.
Source: Coding guidelines
Comment on lines
+248
to
+261
| enabled: {{ .Values.configuration.oauth.dcr.enabled }} | ||
| insecure: {{ .Values.configuration.oauth.dcr.insecure }} | ||
| allowed_auth_methods: | ||
| {{- range .Values.configuration.oauth.allowedAuthMethods }} | ||
| - {{ . | quote }} | ||
| {{- end }} | ||
| allowed_response_types: | ||
| {{- range .Values.configuration.oauth.allowedResponseTypes }} | ||
| - {{ . | quote }} | ||
| {{- end }} | ||
| allowed_grant_types: | ||
| {{- range .Values.configuration.oauth.allowedGrantTypes }} | ||
| - {{ . | quote }} | ||
| {{- end }} |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Render revocation and logout feature toggles.
Unlike dcr.enabled, this template has no path to serialize token_revocation.enabled or logout.enabled. Helm deployments therefore cannot configure the two new OAuth feature gates.
Proposed fix
dcr:
enabled: {{ .Values.configuration.oauth.dcr.enabled }}
insecure: {{ .Values.configuration.oauth.dcr.insecure }}
+ token_revocation:
+ enabled: {{ .Values.configuration.oauth.tokenRevocation.enabled }}
+ logout:
+ enabled: {{ .Values.configuration.oauth.logout.enabled }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| enabled: {{ .Values.configuration.oauth.dcr.enabled }} | |
| insecure: {{ .Values.configuration.oauth.dcr.insecure }} | |
| allowed_auth_methods: | |
| {{- range .Values.configuration.oauth.allowedAuthMethods }} | |
| - {{ . | quote }} | |
| {{- end }} | |
| allowed_response_types: | |
| {{- range .Values.configuration.oauth.allowedResponseTypes }} | |
| - {{ . | quote }} | |
| {{- end }} | |
| allowed_grant_types: | |
| {{- range .Values.configuration.oauth.allowedGrantTypes }} | |
| - {{ . | quote }} | |
| {{- end }} | |
| enabled: {{ .Values.configuration.oauth.dcr.enabled }} | |
| insecure: {{ .Values.configuration.oauth.dcr.insecure }} | |
| token_revocation: | |
| enabled: {{ .Values.configuration.oauth.tokenRevocation.enabled }} | |
| logout: | |
| enabled: {{ .Values.configuration.oauth.logout.enabled }} | |
| allowed_auth_methods: | |
| {{- range .Values.configuration.oauth.allowedAuthMethods }} | |
| - {{ . | quote }} | |
| {{- end }} | |
| allowed_response_types: | |
| {{- range .Values.configuration.oauth.allowedResponseTypes }} | |
| - {{ . | quote }} | |
| {{- end }} | |
| allowed_grant_types: | |
| {{- range .Values.configuration.oauth.allowedGrantTypes }} | |
| - {{ . | quote }} | |
| {{- end }} |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@install/helm/conf/deployment.yaml` around lines 248 - 261, The OAuth
configuration template currently renders only DCR and method lists, omitting the
new token revocation and logout feature toggles. Update the relevant OAuth
section in the deployment template to serialize
configuration.oauth.tokenRevocation.enabled and
configuration.oauth.logout.enabled alongside dcr.enabled, preserving the
existing Helm value structure and rendering style.
anushasunkada
force-pushed
the
local_main
branch
from
July 23, 2026 18:13
7c2882f to
0c761e4
Compare
senthalan
reviewed
Jul 23, 2026
Comment on lines
+1306
to
+1346
| @@ -1334,7 +1340,10 @@ func translateOAuthValidationError(err error) *tidcommon.ServiceError { | |||
|
|
|||
| // OAuth: token endpoint auth method | |||
| case errors.Is(err, inboundclient.ErrOAuthInvalidTokenEndpointAuthMethod): | |||
| return &ErrorInvalidTokenEndpointAuthMethod | |||
| return tidcommon.CustomServiceError(ErrorInvalidOAuthConfiguration, tidcommon.I18nMessage{ | |||
| Key: "error.applicationservice.invalid_token_endpoint_auth_method", | |||
| DefaultValue: "Invalid token endpoint authentication method", | |||
| }) | |||
Member
There was a problem hiding this comment.
Shall we keep this as it is. With the Application level error codes defined in backend/internal/application/error_constants.go without this custom error
thiva-k
reviewed
Jul 23, 2026
|
|
||
| // DCRConfig holds the Dynamic Client Registration configuration. | ||
| type DCRConfig struct { | ||
| Enabled bool `yaml:"enabled" json:"enabled"` |
Contributor
There was a problem hiding this comment.
Shouldn't this be *bool instead? We are setting the default as true, so if we override this to false via deployment.yaml, the merge logic will ignore zero values(false is the zero value for bool).
Signed-off-by: anushasunkada <anushasunkada@gmail.com>
anushasunkada
force-pushed
the
local_main
branch
from
July 23, 2026 19:58
0c761e4 to
983e810
Compare
senthalan
added
the
trigger-pr-builder
senthalan
approved these changes
Jul 23, 2026
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
DCR — dynamic client registration endpoint + discovery metadata is based on the "oauth.dcr.enabled" flag. By default value is true.
Token revocation — /oauth2/revoke endpoint + deny-list enforcement on the token-validation hot path is now enabled on the "oauth.token_revocation.enabled" flag. By default value is true.
Logout — RP-initiated logout endpoint + end_session_endpoint discovery metadata depends on "oauth.logout.enabled" flag. By default value is true.
CIBA — gated by allowed_grant_types, now also skips initializing the CIBA service entirely when the grant type isn't allowed. if "allowed_grant_types" is empty all the available grant types are supported.
-->
Approach
Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks
Summary by CodeRabbit
400when CIBA isn’t enabled.