feat(oauth2): support custom URI schemes for Native clients across redirect_uris, allowed_origins, post_logout_redirect_uris by smarcet · Pull Request #147 · OpenStackweb/openstackid

feat(oauth2): support custom URI schemes for Native clients across redirect_uris, allowed_origins, post_logout_redirect_uris

smarcet

committed

b62d202

refactor(oauth2): relocate Native-client scheme deny-list from HttpUtils to IClient/Client; stop duplicating it in the frontend

smarcet

committed

7e7a5a8

docs(adr): record ADR-0001 for Native client custom URI scheme support

smarcet

committed

097458f

fix(oauth2): validate redirect_uris scheme/uniqueness on client create, not just update

smarcet

committed

2c22094

fix(oauth2): validate custom URI scheme lists on client create()

smarcet

committed

37bda36

fix(oauth2): exact-match redirect_uris, declare scheme predicate on IClient

smarcet

committed

3c0778c

fix(oauth2): exact-match post_logout_redirect_uris, closing the CodeRabbit-flagged gap

smarcet

committed

9dde6d1

fix(oauth2): exact-match isOriginAllowed(), closing the last substring-bypass gap

smarcet

committed

d853160

fix(oauth2): serialize Native client custom-scheme create/update behind a Redis lock

smarcet

committed

4b37638

test(oauth2): document query-string/path-casing gap in URI matching (review Finding 2)

smarcet

committed

dda5e98

fix(oauth2): scope Native client custom-scheme lock to payloads that touch URI fields

smarcet

committed

3ac133b

fix(utils): auto-recover stuck locks - relative TTL and release on any Throwable

smarcet

committed

e8738a2

test(oauth2): clear stale facade instances in OAuth2LoginStrategyTest setUp

smarcet

committed

f394046

fix(oauth2): release facade state in tearDown even if Mockery::close() throws

smarcet

committed

6c1b1b5

fix(oauth2): ignore port when matching Native http-loopback redirect_uris (RFC 8252 §7.3)

smarcet

committed

3652448

fix(oauth2): detect custom-scheme collisions in legacy space-separated URI lists

smarcet

committed

32921c9

docs(adr): record loopback port matching, legacy-list tolerance, and isOriginAllowed trade-off

smarcet

committed

eb950e5

docs(adr): note create() URI validation is a contract change for non-Native clients too

smarcet

committed

2f8b9c2

fix(oauth2): guard isOriginAllowed against null normalization results

smarcet

committed

580e4ea

feat(oauth2): support RFC 8252 §7.1 authority-less custom-scheme URIs end-to-end

smarcet

committed

db9fe57

test: re-enable the OAuth2 protocol suite excluded by its *TestCase.php filename

smarcet

committed

0114035

refactor(oauth2): consolidate runtime URI matching into a single pipeline

smarcet

committed

614ade5

fix(oauth2): ignore port when matching Native http-loopback post_logout_redirect_uris

smarcet

committed

9a800bf

fix(oauth2): enforce native scheme deny-list on redirect_uris UI, stop blocking legit custom schemes

smarcet

committed

0205b19

fix(oauth2): reject opaque URIs at write time - the runtime can never match them

smarcet

committed

01ecbf5

Navigation Menu

Uh oh!

feat(oauth2): support custom URI schemes for Native clients across redirect_uris, allowed_origins, post_logout_redirect_uris - #147

feat(oauth2): support custom URI schemes for Native clients across redirect_uris, allowed_origins, post_logout_redirect_uris#147
smarcet merged 25 commits into
mainfrom
hotfix/native-app-custom-schemas

Commits on Aug 6, 2026

feat(oauth2): support custom URI schemes for Native clients across redirect_uris, allowed_origins, post_logout_redirect_uris

refactor(oauth2): relocate Native-client scheme deny-list from HttpUtils to IClient/Client; stop duplicating it in the frontend

docs(adr): record ADR-0001 for Native client custom URI scheme support

fix(oauth2): validate redirect_uris scheme/uniqueness on client create, not just update

fix(oauth2): validate custom URI scheme lists on client create()

fix(oauth2): exact-match redirect_uris, declare scheme predicate on IClient

fix(oauth2): exact-match post_logout_redirect_uris, closing the CodeRabbit-flagged gap

fix(oauth2): exact-match isOriginAllowed(), closing the last substring-bypass gap

fix(oauth2): serialize Native client custom-scheme create/update behind a Redis lock

test(oauth2): document query-string/path-casing gap in URI matching (review Finding 2)

fix(oauth2): scope Native client custom-scheme lock to payloads that touch URI fields

fix(utils): auto-recover stuck locks - relative TTL and release on any Throwable

test(oauth2): clear stale facade instances in OAuth2LoginStrategyTest setUp

fix(oauth2): release facade state in tearDown even if Mockery::close() throws

fix(oauth2): ignore port when matching Native http-loopback redirect_uris (RFC 8252 §7.3)

fix(oauth2): detect custom-scheme collisions in legacy space-separated URI lists

docs(adr): record loopback port matching, legacy-list tolerance, and isOriginAllowed trade-off

docs(adr): note create() URI validation is a contract change for non-Native clients too

fix(oauth2): guard isOriginAllowed against null normalization results

feat(oauth2): support RFC 8252 §7.1 authority-less custom-scheme URIs end-to-end

test: re-enable the OAuth2 protocol suite excluded by its *TestCase.php filename

refactor(oauth2): consolidate runtime URI matching into a single pipeline

fix(oauth2): ignore port when matching Native http-loopback post_logout_redirect_uris

fix(oauth2): enforce native scheme deny-list on redirect_uris UI, stop blocking legit custom schemes

fix(oauth2): reject opaque URIs at write time - the runtime can never match them