refactor(oidc): Only support public clients#4634
Conversation
Public clients are clients with only a client ID, and no secret or other authentication method. It should be the most common case and allows to simplify several APIs. Signed-off-by: Kévin Commaille <zecakeh@tedomum.fr>
Signed-off-by: Kévin Commaille <zecakeh@tedomum.fr>
This simplifies the registration flow, and matches what higher level methods are doing. Signed-off-by: Kévin Commaille <zecakeh@tedomum.fr>
Signed-off-by: Kévin Commaille <zecakeh@tedomum.fr>
Signed-off-by: Kévin Commaille <zecakeh@tedomum.fr>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4634 +/- ##
=======================================
Coverage 85.70% 85.70%
=======================================
Files 292 292
Lines 33590 33586 -4
=======================================
- Hits 28788 28786 -2
+ Misses 4802 4800 -2 ☔ View full report in Codecov by Sentry. |
jmartinesp
left a comment
jmartinesp
left a comment
There was a problem hiding this comment.
The changes LGTM in general, but I'd rather have someone else with more experience in this part of the SDK review it too. I'm not sure I fully understand what this change would mean for the clients.
@matrix-org/rust ?
| .client_id() | ||
| .to_owned(); | ||
| let client_id = | ||
| api.client_id().context("OIDC client credentials are missing.")?.0.clone(); |
There was a problem hiding this comment.
This message is probably not accurate now.
|
cc @pixlwave do you have a feedback about this change? |
|
Looks reasonable to me. We've only ever extracted the client ID out of the credentials/created credentials from a client ID anyway so this shouldn't have any effect to us. |
Signed-off-by: Kévin Commaille <zecakeh@tedomum.fr>
poljar
left a comment
poljar
left a comment
There was a problem hiding this comment.
Yup, makes sense.
Could you please resolve the conflict?
Signed-off-by: Kévin Commaille <zecakeh@tedomum.fr>
|
Done |
Rebase failed
This should be the most common case, and is already the only case supported by the higher level APIs like `url_for_oidc` and `login_with_qr_code`. It simplifies the API because we can call `restore_registered_client` directly from `register_client`, which was a TODO. - [x] Public API changes documented in changelogs (optional) --------- Signed-off-by: Kévin Commaille <zecakeh@tedomum.fr>
6 participants
This should be the most common case, and is already the only case supported by the higher level APIs like
url_for_oidcandlogin_with_qr_code. It simplifies the API because we can callrestore_registered_clientdirectly fromregister_client, which was a TODO.