Gustavo Valverde 2ef5a353be fix(oauth-provider)!: make client authentication grant-bound and single-authority ...

The OAuth Provider extension surface let a grant handler drift from what it issued in two ways. The client-registration check honored a request-supplied grant type while issuance used the provider-bound grant, so a handler could authenticate a client for a permissive grant and mint under a stricter one. And a client-authentication strategy returned the client record the provider then authorized against, so a strategy could supply a client's grants, scopes, or enabled state.

The provider-bound grant is now the sole authority for the registration check, and grantType is removed from OAuthClientAuthenticationRequest. A strategy proves only the client id it authenticated (plus an optional confirmation); the provider resolves and authorizes the client record itself via getClient. The strategy result type is now OAuthClientAuthenticationResult.

2026-06-14 20:23:47 -07:00

..

blogs

fix(open-api): generate valid OpenAPI schemas for client generators (#9555)

2026-06-12 22:24:56 +00:00

changelogs

chore(docs): format markdown including mdx files (#9085)

2026-04-10 05:09:33 +00:00

docs

fix(oauth-provider)!: make client authentication grant-bound and single-authority

2026-06-14 20:23:47 -07:00

docs-beta

docs: add stable/beta versioning with build-time content sync (#9258)

2026-04-21 03:49:33 +00:00