dkam/clinch
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

DCR: accept every grant type discovery advertises

Browse Source 
Discovery advertised the device_code grant in grant_types_supported, but dynamic
client registration only allowed authorization_code/refresh_token, so a client
listing the device grant in its RFC 7591 metadata was rejected with
invalid_client_metadata.

Introduce a single source of truth — OidcController::SUPPORTED_GRANT_TYPES —
used by discovery (grant_types_supported) and by registration validation, so
advertisement and registration can never drift. The token dispatcher already
handles exactly these grants for all clients (they are user-context grants gated
by consent + user_allowed?, so there is no per-client grant restriction), making
advertisement, registration, and enforcement consistent.

Tests: a client registering with the device_code grant now succeeds, plus an
assertion that registration's accepted set equals discovery's advertised set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F7cwhwDJp3MJJDoNPVE6zq
This commit is contained in:
Dan Milne
2026-07-19 13:59:35 +10:00
co-authored by Claude Opus 4.8
parent 71ee301dd2
commit 7eddea8356
3 changed files with 41 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/oidc_registration_controller.rb
+9 -3
View File
@@ -16,9 +16,15 @@ class OidcRegistrationController < ApplicationController
}
AUTH_METHODS = %w[none client_secret_basic client_secret_post].freeze
SUPPORTED_GRANT_TYPES = %w[authorization_code refresh_token].freeze
SUPPORTED_RESPONSE_TYPES = %w[code].freeze
# Accept exactly the grant types the authorization server advertises in
# discovery (single source of truth), so a client cannot be rejected for
# requesting a grant the server actually supports (e.g. the device_code grant).
def supported_grant_types
OidcController::SUPPORTED_GRANT_TYPES
end
# POST /oauth/register
def create
unless Application.dynamic_registration_enabled?
@@ -37,8 +43,8 @@ class OidcRegistrationController < ApplicationController
end
grant_types = Array(metadata["grant_types"].presence || ["authorization_code"])
if (grant_types - SUPPORTED_GRANT_TYPES).any?
return register_error("invalid_client_metadata", "Unsupported grant_types; only #{SUPPORTED_GRANT_TYPES.join(", ")} are allowed")
if (grant_types - supported_grant_types).any?
return register_error("invalid_client_metadata", "Unsupported grant_types; only #{supported_grant_types.join(", ")} are allowed")
end
response_types = Array(metadata["response_types"].presence || ["code"])