Improve signing/encryption related token configurations - #4423
Merged
Conversation
thiva-k
requested review from
DonOmalVindula,
ThaminduDilshan,
brionmario,
jeradrutnam and
rajithacharith
as code owners
July 30, 2026 06:49
thiva-k
added
Type/Improvement
trigger-pr-builder
Contributor
📝 WalkthroughWalkthroughOAuth/OIDC validation now permits certificates with ChangesOAuth/OIDC configuration
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant EditTokenSettings
participant OIDCDiscovery
participant TokenUserAttributesSection
participant CertificateSection
EditTokenSettings->>OIDCDiscovery: fetch signing algorithm metadata
OIDCDiscovery-->>EditTokenSettings: return supported signing algorithm
EditTokenSettings->>TokenUserAttributesSection: pass signing and certificate state
TokenUserAttributesSection->>CertificateSection: enforce certificate dependency
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (4)
docs/content/guides/protocols/oauth-oidc/userinfo.mdx (1)
61-61: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSplit the encryption setup into explicit steps.
This combines selecting algorithms with configuring a certificate, and the certificate location differs between applications and agents. Separate the actions and identify the relevant certificate section.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/content/guides/protocols/oauth-oidc/userinfo.mdx` at line 61, Update the UserInfo protocol guide’s encrypted-response instructions to separate choosing JWE encryption algorithms from configuring the certificate. Identify the appropriate certificate configuration section, including the distinct certificate locations for applications and agents.Source: Coding guidelines
frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsx (1)
69-141: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoffConsider extracting the shared
CertificateSectioninstead of maintaining two copies.
frontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsxnow carries a byte-identical implementation of this component, including the newencryptionDependsOnCert/blockedRemovallogic and the sameapplications:edit.advanced.certificate.*keys. The next behavior change has to be applied twice.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsx` around lines 69 - 141, Extract the shared CertificateSection implementation, including the encryptionDependsOnCert and blockedRemoval logic, into a reusable component. Replace both the application and agent CertificateSection copies with imports of that shared component, preserving the existing props, behavior, and applications:edit.advanced.certificate.* translation keys.frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx (2)
246-246: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winThe "which formats are encrypted" rule is now spelled out in four places. Each site re-derives
'JWE' | 'NESTED_JWT'inline, so adding or renaming an encrypted format means finding every copy; the agent-sideEditCredentialsSettingscarries a fifth copy.isEncryptedFormatalready exists here and is the natural thing to export fromtoken-constants.ts.
frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx#L246-L246: moveisEncryptedFormatintotoken-constants.tsand import it here.frontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettings.tsx#L522-L522: replace the inlinevalue !== 'JWE' && value !== 'NESTED_JWT'check with!isEncryptedFormat(value).frontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettings.tsx#L550-L550: same replacement inhandleUserInfoConfigChange.frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsx#L146-L150: buildencryptionDependsOnCertasisEncryptedFormat(idTokenResponseType) || isEncryptedFormat(userInfoResponseType).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx` at line 246, Centralize the encrypted-format rule by moving isEncryptedFormat from TokenUserAttributesSection.tsx into token-constants.ts, exporting it, and importing it where needed. In TokenUserAttributesSection.tsx, EditTokenSettings.tsx at lines 522 and 550, and EditAdvancedSettings.tsx at lines 146-150, replace each inline JWE/NESTED_JWT check with isEncryptedFormat; build encryptionDependsOnCert using the helper for both response types.
214-216: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUntranslated tab names are interpolated into a translated sentence.
certificateLocationis passed and defaulted as a raw English display string, then substituted intoedit.token.encryption_requires_certificatevia{{location}}. In any non-English locale the hint renders as translated prose with an English tab name inside it, and it will also drift from the actual tab labels (applications:edit.page.tabs.advanced,agents:edit.page.tabs.credentials). Passing a translation key (or a'advanced' | 'credentials'discriminator resolved witht()at render time) keeps the whole sentence localized.
frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx#L214-L216: changecertificateLocationto a key/discriminator and resolve it witht()before interpolating into the alert at Lines 570-574 and 769-773.frontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettings.tsx#L148-L148: replace the'Advanced Settings'default with the corresponding key/discriminator.frontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsx#L98-L98: replacecertificateLocation="Credentials"with the corresponding key/discriminator.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx` around lines 214 - 216, Replace the raw certificateLocation display strings with a translation key or advanced/credentials discriminator across TokenUserAttributesSection.tsx (lines 214-216), EditTokenSettings.tsx (line 148), and EditTokensSettings.tsx (line 98). In TokenUserAttributesSection, resolve the discriminator through t() before interpolating it into the alerts at the existing encryption_requires_certificate usages, using the matching applications:edit.page.tabs.advanced or agents:edit.page.tabs.credentials labels.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/content/guides/protocols/oauth-oidc/token-formats.mdx`:
- Line 48: Update the sentence in the token formats documentation to hyphenate
the compound modifier as “RSA-based,” without changing the surrounding guidance
about the client certificate or selected algorithm.
In
`@frontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettings.tsx`:
- Around line 339-364: Update the discovery-fetch useEffect around
fetchSigningAlg to use the existing cancelled-flag pattern: set the flag in the
cleanup function, check it before applying the response via setSigningAlg, and
prevent stale requests from updating state after unmount or getServerUrl
changes. Remove the unreachable outer fetchSigningAlg().catch handler while
preserving the existing internal error logging.
In
`@frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx`:
- Around line 789-793: Update the two UserInfo placeholder translation calls in
TokenUserAttributesSection, including the renderValue lookup and the
corresponding lookup near the encryption settings, to provide explicit fallback
default strings via the established t() convention. Keep the existing
translation keys and rendered placeholder behavior unchanged.
---
Nitpick comments:
In `@docs/content/guides/protocols/oauth-oidc/userinfo.mdx`:
- Line 61: Update the UserInfo protocol guide’s encrypted-response instructions
to separate choosing JWE encryption algorithms from configuring the certificate.
Identify the appropriate certificate configuration section, including the
distinct certificate locations for applications and agents.
In
`@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsx`:
- Around line 69-141: Extract the shared CertificateSection implementation,
including the encryptionDependsOnCert and blockedRemoval logic, into a reusable
component. Replace both the application and agent CertificateSection copies with
imports of that shared component, preserving the existing props, behavior, and
applications:edit.advanced.certificate.* translation keys.
In
`@frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx`:
- Line 246: Centralize the encrypted-format rule by moving isEncryptedFormat
from TokenUserAttributesSection.tsx into token-constants.ts, exporting it, and
importing it where needed. In TokenUserAttributesSection.tsx,
EditTokenSettings.tsx at lines 522 and 550, and EditAdvancedSettings.tsx at
lines 146-150, replace each inline JWE/NESTED_JWT check with isEncryptedFormat;
build encryptionDependsOnCert using the helper for both response types.
- Around line 214-216: Replace the raw certificateLocation display strings with
a translation key or advanced/credentials discriminator across
TokenUserAttributesSection.tsx (lines 214-216), EditTokenSettings.tsx (line
148), and EditTokensSettings.tsx (line 98). In TokenUserAttributesSection,
resolve the discriminator through t() before interpolating it into the alerts at
the existing encryption_requires_certificate usages, using the matching
applications:edit.page.tabs.advanced or agents:edit.page.tabs.credentials
labels.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 38dbcaaa-8259-4716-87fe-9e9d4d5c4a15
📒 Files selected for processing (24)
backend/internal/agent/service.gobackend/internal/agent/service_test.gobackend/internal/application/service.gobackend/internal/application/service_test.gobackend/internal/inboundclient/error_constants.gobackend/internal/inboundclient/service.gobackend/internal/inboundclient/service_test.gobackend/internal/system/i18n/core/defaults.godocs/content/guides/protocols/oauth-oidc/dynamic-client-registration.mdxdocs/content/guides/protocols/oauth-oidc/openid-connect.mdxdocs/content/guides/protocols/oauth-oidc/token-formats.mdxdocs/content/guides/protocols/oauth-oidc/userinfo.mdxfrontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsxfrontend/apps/console/src/features/agents/components/edit-agent/credentials/EditCredentialsSettings.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/CertificateSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/EditTokenSettings.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/TokenUserAttributesSection.test.tsxfrontend/apps/console/src/features/applications/constants/token-constants.tsfrontend/packages/i18n/src/locales/en-US.ts
💤 Files with no reviewable changes (1)
- frontend/apps/console/src/features/applications/constants/token-constants.ts
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
frontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsx (1)
46-115: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winStale "blocked removal" warning in both
CertificateSectionimplementations. Both components gate the warningAlerton localblockedRemovalstate that is only cleared inside this component's ownonChangehandler, not when the underlyingencryptionDependsOnCertprop later becomesfalse(e.g. after the user changes the ID token/UserInfo format elsewhere, as the warning itself instructs). The warning then keeps showing a no-longer-applicable message until the user re-opens this certificate dropdown.
frontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsx#L46-L115: change the Alert condition to{blockedRemoval && encryptionDependsOnCert && (...)}so it clears automatically once the format dependency resolves.frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsx#L78-L142: apply the same{blockedRemoval && encryptionDependsOnCert && (...)}gate.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsx` around lines 46 - 115, The blocked-removal warning remains visible after its encryption dependency is resolved. In both CertificateSection implementations—frontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsx:46-115 and frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsx:78-142—update the warning Alert condition to require both blockedRemoval and encryptionDependsOnCert, preserving the existing alert content and behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@frontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsx`:
- Line 46: Gate the blocked-removal Alert in CertificateSection on both
blockedRemoval and the live encryptionDependsOnCert prop, so it disappears
immediately when the underlying dependency resolves. Update the related
warning/rendering logic around the certificate type change handler without
relying solely on the local setBlockedRemoval reset; apply the same pattern in
the corresponding advanced-settings CertificateSection.
In
`@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsx`:
- Line 78: Update CertificateSection’s blockedRemoval state handling so it is
cleared whenever encryptionDependsOnCert becomes false, including changes
originating from ID token or UserInfo response types in
EditAdvancedSettings.tsx. Add the reset alongside the existing dropdown logic
and preserve the current warning behavior while the dependency remains true.
In
`@frontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettings.tsx`:
- Around line 801-803: Update the hasCertificate prop passed by
EditTokenSettings to require both oauth2Config.certificate.type and a non-empty
certificate value. Ensure JWE/NESTED_JWT formats cannot be enabled with a blank
certificate, and JWKS_URI still reaches the SSRF-safe URL validation instead of
bypassing it.
---
Outside diff comments:
In
`@frontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsx`:
- Around line 46-115: The blocked-removal warning remains visible after its
encryption dependency is resolved. In both CertificateSection
implementations—frontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsx:46-115
and
frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsx:78-142—update
the warning Alert condition to require both blockedRemoval and
encryptionDependsOnCert, preserving the existing alert content and behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 603422fb-dc59-4d33-bde8-279b96fbdc16
📒 Files selected for processing (24)
backend/internal/agent/service.gobackend/internal/agent/service_test.gobackend/internal/application/service.gobackend/internal/application/service_test.gobackend/internal/inboundclient/error_constants.gobackend/internal/inboundclient/service.gobackend/internal/inboundclient/service_test.gobackend/internal/system/i18n/core/defaults.godocs/content/guides/protocols/oauth-oidc/dynamic-client-registration.mdxdocs/content/guides/protocols/oauth-oidc/openid-connect.mdxdocs/content/guides/protocols/oauth-oidc/token-formats.mdxdocs/content/guides/protocols/oauth-oidc/userinfo.mdxfrontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsxfrontend/apps/console/src/features/agents/components/edit-agent/credentials/EditCredentialsSettings.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/CertificateSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/EditTokenSettings.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/TokenUserAttributesSection.test.tsxfrontend/apps/console/src/features/applications/constants/token-constants.tsfrontend/packages/i18n/src/locales/en-US.ts
💤 Files with no reviewable changes (1)
- frontend/apps/console/src/features/applications/constants/token-constants.ts
🚧 Files skipped from review as they are similar to previous changes (7)
- docs/content/guides/protocols/oauth-oidc/openid-connect.mdx
- docs/content/guides/protocols/oauth-oidc/dynamic-client-registration.mdx
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsx
- docs/content/guides/protocols/oauth-oidc/userinfo.mdx
- backend/internal/system/i18n/core/defaults.go
- docs/content/guides/protocols/oauth-oidc/token-formats.mdx
- frontend/packages/i18n/src/locales/en-US.ts
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (3)
frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsx (1)
142-151: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider a shared
isEncryptedFormathelper.The
'JWE' | 'NESTED_JWT'check is now duplicated here, inEditCredentialsSettings.tsx, inEditTokenSettings.tsx(both change handlers), and inTokenUserAttributesSection.tsx. Exporting one predicate fromconstants/token-constants.tskeeps these in sync when a new encrypted format is added.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsx` around lines 142 - 151, Extract and export a shared isEncryptedFormat predicate from constants/token-constants.ts that recognizes JWE and NESTED_JWT response types, then replace the duplicated format checks in EditAdvancedSettings, EditCredentialsSettings, both EditTokenSettings change handlers, and TokenUserAttributesSection with this helper.frontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsx (1)
98-98: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueInterpolated tab name won't localize.
certificateLocationis a hardcoded English string injected into the translatedencryption_requires_certificatesentence, so non-English locales will render a mixed-language hint. Passing the existing tab label key (agents:edit.page.tabs.credentials) resolved viat()would keep it localized.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsx` at line 98, Update the certificateLocation value in EditTokensSettings to use the existing credentials tab translation via t() with the agents:edit.page.tabs.credentials key, instead of the hardcoded "Credentials" string, while preserving the surrounding encryption_requires_certificate translation flow.frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx (1)
560-568: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAlign this condition with the UserInfo allow-list.
The ID token branch excludes
JWE(fail-open: any future format shows "Signed with"), while the UserInfo branch at Lines 769-770 uses an explicitJWS | NESTED_JWTallow-list. Matching the allow-list style here keeps both consistent and correct if a new format is introduced.♻️ Proposed change
- {signingAlg && (idTokenResponseType ?? 'JWT') !== 'JWE' && ( + {signingAlg && + ((idTokenResponseType ?? 'JWT') === 'JWT' || idTokenResponseType === 'NESTED_JWT') && (🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx` around lines 560 - 568, Update the signing-algorithm display condition in the ID token section of TokenUserAttributesSection so it uses the same explicit JWS/NESTED_JWT allow-list as the UserInfo branch, rather than excluding only JWE. Preserve the existing signingAlg requirement and display behavior for those supported formats.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@frontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsx`:
- Line 98: Update the certificateLocation value in EditTokensSettings to use the
existing credentials tab translation via t() with the
agents:edit.page.tabs.credentials key, instead of the hardcoded "Credentials"
string, while preserving the surrounding encryption_requires_certificate
translation flow.
In
`@frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsx`:
- Around line 142-151: Extract and export a shared isEncryptedFormat predicate
from constants/token-constants.ts that recognizes JWE and NESTED_JWT response
types, then replace the duplicated format checks in EditAdvancedSettings,
EditCredentialsSettings, both EditTokenSettings change handlers, and
TokenUserAttributesSection with this helper.
In
`@frontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsx`:
- Around line 560-568: Update the signing-algorithm display condition in the ID
token section of TokenUserAttributesSection so it uses the same explicit
JWS/NESTED_JWT allow-list as the UserInfo branch, rather than excluding only
JWE. Preserve the existing signingAlg requirement and display behavior for those
supported formats.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a5230190-5dee-4477-9c30-8780b0cbb631
📒 Files selected for processing (24)
backend/internal/agent/service.gobackend/internal/agent/service_test.gobackend/internal/application/service.gobackend/internal/application/service_test.gobackend/internal/inboundclient/error_constants.gobackend/internal/inboundclient/service.gobackend/internal/inboundclient/service_test.gobackend/internal/system/i18n/core/defaults.godocs/content/guides/protocols/oauth-oidc/dynamic-client-registration.mdxdocs/content/guides/protocols/oauth-oidc/openid-connect.mdxdocs/content/guides/protocols/oauth-oidc/token-formats.mdxdocs/content/guides/protocols/oauth-oidc/userinfo.mdxfrontend/apps/console/src/features/agents/components/edit-agent/credentials/CertificateSection.tsxfrontend/apps/console/src/features/agents/components/edit-agent/credentials/EditCredentialsSettings.tsxfrontend/apps/console/src/features/agents/components/edit-agent/tokens/EditTokensSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/CertificateSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/EditAdvancedSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/advanced-settings/__tests__/CertificateSection.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/EditTokenSettings.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/TokenUserAttributesSection.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/EditTokenSettings.test.tsxfrontend/apps/console/src/features/applications/components/edit-application/token-settings/__tests__/TokenUserAttributesSection.test.tsxfrontend/apps/console/src/features/applications/constants/token-constants.tsfrontend/packages/i18n/src/locales/en-US.ts
💤 Files with no reviewable changes (1)
- frontend/apps/console/src/features/applications/constants/token-constants.ts
🚧 Files skipped from review as they are similar to previous changes (5)
- docs/content/guides/protocols/oauth-oidc/openid-connect.mdx
- docs/content/guides/protocols/oauth-oidc/dynamic-client-registration.mdx
- docs/content/guides/protocols/oauth-oidc/token-formats.mdx
- frontend/apps/console/src/features/applications/components/edit-application/advanced-settings/tests/CertificateSection.test.tsx
- docs/content/guides/protocols/oauth-oidc/userinfo.mdx
ThaminduDilshan
approved these changes
Jul 30, 2026
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Improve the signing and encryption related configurations for OAuth tokens across the Console, backend, and docs.
signingAlg.client_secret/noneclient can now attach a certificate for token encryption; removing a certificate an encrypted format still depends on is blocked in the UI with a clear warning.id_token_signed_response_algDCR field, and noted encryption requires an RSA client key.Related Issues