Repository navigation
Persist server-registered scopes on DCR clients and limit later sign-ins (upstream #2402) #68
Description
Follow-up from #67 (which did not port upstream UsefulSoftwareCo#2402 / UsefulSoftwareCo#2403).
Goal: store the scopes the authorization server actually registered on dynamically registered (DCR) OAuth clients, and limit later sign-ins to those scopes.
Context: v2 already avoids UsefulSoftwareCo#2403's invalid_scope bug, because it reuses a DCR client only when the full registration, including the sorted scope set, matches (packages/sdk/src/implementation/oauth.ts:1103, stored-oauth-client-credentials.ts:184). What's missing is persisting server-registered scopes and limiting to them.
- Storage migration for registered scopes on stored OAuth clients, following the online-migration rules (expand → backfill → contract, no blocking DDL)
- Limit later sign-ins to the registered scopes
- An e2e scenario that replaces Test DCR registered-scope reuse and start narrowing UsefulSoftwareCo/executor#2403's unit tests
Activity