feat(oauth2): support custom URI schemes for Native clients across redirect_uris, allowed_origins, post_logout_redirect_uris - #147

Open

smarcet wants to merge 14 commits into

mainfrom

hotfix/native-app-custom-schemas

Commits on Jul 14, 2026

feat(oauth2): support custom URI schemes for Native clients across redirect_uris, allowed_origins, post_logout_redirect_uris
smarcet
committed

Commits on Jul 15, 2026

refactor(oauth2): relocate Native-client scheme deny-list from HttpUtils to IClient/Client; stop duplicating it in the frontend
smarcet
committed
docs(adr): record ADR-0001 for Native client custom URI scheme support
smarcet
committed
fix(oauth2): validate redirect_uris scheme/uniqueness on client create, not just update
smarcet
committed
fix(oauth2): validate custom URI scheme lists on client create()
smarcet
committed
fix(oauth2): exact-match redirect_uris, declare scheme predicate on IClient
smarcet
committed
fix(oauth2): exact-match post_logout_redirect_uris, closing the CodeRabbit-flagged gap
smarcet
committed
fix(oauth2): exact-match isOriginAllowed(), closing the last substring-bypass gap
smarcet
committed
fix(oauth2): serialize Native client custom-scheme create/update behind a Redis lock
smarcet
committed
test(oauth2): document query-string/path-casing gap in URI matching (review Finding 2)
smarcet
committed
fix(oauth2): scope Native client custom-scheme lock to payloads that touch URI fields
smarcet
committed
fix(utils): auto-recover stuck locks - relative TTL and release on any Throwable
smarcet
committed
test(oauth2): clear stale facade instances in OAuth2LoginStrategyTest setUp
smarcet
committed

Commits on Jul 16, 2026

fix(oauth2): release facade state in tearDown even if Mockery::close() throws
smarcet
committed