feat(oauth): update library to v0.1.6 and surface client URI - #656
Conversation
This comment has been minimized.
This comment has been minimized.
Bump go.lumeweb.com/oauth to v0.1.6, which persists resolved CIMD clients (and their URL-form client URI) into the oauth storage layer. Add a goose migration adding the oauth_clients.client_uri column so the v0.1.6 GORM storage can read/write it on existing databases. Surface the client URI on the OAuth authorize/login page so a resource owner can see which publisher (RFC 9291 client_id metadata document URL) is requesting access. The value is resolved via a best-effort store read only (never an outbound CIMD fetch), matching the SSRF-safe design in LumeWeb/portal#1852.
d0afb86 to
e00030f
Compare
|
Unbounded database query in Kody rule violation: Disallow GORM queries without timeout |
![kody-ai[bot]](https://avatars.githubusercontent.com/in/413034?s=60&v=4){kind=small}
Kody K# (stored XSS): client_uri is influenced by the connecting client (it is persisted from the CIMD document the client publishes), so rendering it unvalidated in an <a href> could let a javascript:/data: scheme execute in the resource owner's browser. Only an absolute http(s) client_uri is now surfaced on the authorize page; all other values render no link. Adds regression tests covering a valid https client_uri (surfaced) and javascript:/data:/relative/scheme-less values (suppressed).
Kody Review CompleteGreat news! 🎉 Keep up the excellent work! 🚀 Kody Guide: Usage and ConfigurationInteracting with Kody
Current Kody ConfigurationReview OptionsThe following review options are enabled or disabled:
|
Code Coverage ReportTotal Coverage: 50.1% Generated from commit: 0f9b21b |
1 participant
Mirrors the finalized LumeWeb/portal#1852: bumps
go.lumeweb.com/oauthto v0.1.6 and wires up OAuth client URI support.Changes
Library bump
go.mod/go.sum:go.lumeweb.com/oauthv0.1.5 → v0.1.6. v0.1.6 persists resolved CIMD clients (RFC 9291) and their URL-formclient_uriinto the storage layer.Migration
00004_oauth_clients_add_client_uri.sqladdsoauth_clients.client_uri(sqlite; pinner-cli is sqlite-only) so the v0.1.6 GORM storage can read/write the column on existing databases.Client URI surfacing
client_uri(its RFC 9291 metadata document URL) so the resource owner can see which publisher is requesting access.store.GetClient) — never via an outbound CIMD fetch. CIMD clients persisted by the library round-trip theirclient_urithrough the store, so the authorize page surfaces it without resolving the metadata document again.Testing
make testpasses across the full suite (assets +go test -tags sqlite_fts5 ./...).Summary
This pull request updates the OAuth library to v0.1.6 and introduces a new feature to surface the client URI (publisher information) on the OAuth authorization page.
Changes
Database Migration
00004_oauth_clients_add_client_uri.sql) that adds aclient_uricolumn to theoauth_clientstable to store the client's metadata document URL.OAuth Server Updates
clientForDisplaywas added to retrieve stored client information for a given client ID. This is a best-effort, read-only operation that returns an empty record if the client is unknown or not persisted—it never performs an outbound CIMD fetch.AuthorizeGETandAuthorizePOSThandlers to populate the newClientURIfield in the authorization page data by looking up the client's stored URI.Login Page UI Enhancement
ClientURIfield to theoauthAuthorizeDatatemplate struct.The change improves transparency on the OAuth authorization page by showing users which publisher is requesting access, based on stored client metadata rather than performing additional network requests.