starred/documenso

Fork 0

mirror of https://github.com/documenso/documenso.git synced 2026-04-26 06:15:58 +03:00

[PR #1479] [MERGED] feat: ignore unrecognized fields from authorization response #1659

New issue

Closed

opened 2026-02-26 19:34:12 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 19:34:12 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/documenso/documenso/pull/1479
Author: @samuelraub
Created: 11/15/2024
Status: ✅ Merged
Merged: 1/13/2025
Merged by: @Mythie

Base: main ← Head: feat/1475-ignore-unrecognized-fields-from-authorization-response

📝 Commits (3)

24277f2 feat: ignore unrecognized fields from authorization response
c652755 Merge branch 'main' into feat/1475-ignore-unrecognized-fields-from-authorization-response
13a9f34 fix: use reduce to create the linkAccount data

📊 Changes

1 file changed (+32 additions, -1 deletions)

View changed files

📝 packages/lib/next-auth/auth-options.ts (+32 -1)

📄 Description

name: Pull Request
about: Submit changes to the project for review and inclusion

Description

In the context of OIDC: Some IDPs send additional fields in their authorization response. This leads to an error because these fields can't be persisted to the DB through auth.js prisma adapter. This PR solves this by deleting all unrecognized fields from the authorization response before persisting. This behaviour is also compliant to RFC6749 Section 4.1.2 (<-- OAuth2)

Addresses #1475

Changes Made

grab a list of all fields of the Account model
delete all other fields from the OAuth2 authorization response
hand the data back to auth.js prisma adapter

Testing Performed

Tested that OIDC sign in works now with Keycloak, that sends the following additional fields in their authorization response: refresh_expires_in and not-before-policy.

Checklist

I have tested these changes locally and they work as expected.
I have added/updated tests that prove the effectiveness of these changes.
I have updated the documentation to reflect these changes, if applicable.
I have followed the project's coding style guidelines.
I have addressed the code review feedback from the previous submission, if applicable.

Additional Notes

Summary by CodeRabbit

New Features
- Introduced a custom account linking method to enhance OAuth compliance.
- Updated authentication options to utilize a refined adapter for better account management.
Bug Fixes
- Improved filtering of unrecognized fields in the authorization response for more accurate account linking.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/documenso/documenso/pull/1479 **Author:** [@samuelraub](https://github.com/samuelraub) **Created:** 11/15/2024 **Status:** ✅ Merged **Merged:** 1/13/2025 **Merged by:** [@Mythie](https://github.com/Mythie) **Base:** `main` ← **Head:** `feat/1475-ignore-unrecognized-fields-from-authorization-response` --- ### 📝 Commits (3) - [`24277f2`](https://github.com/documenso/documenso/commit/24277f23b3e4e4996f36e8dfc2d2dffae9cf8998) feat: ignore unrecognized fields from authorization response - [`c652755`](https://github.com/documenso/documenso/commit/c6527556db8438e3d1cfb5c629fa1b7cd290cf18) Merge branch 'main' into feat/1475-ignore-unrecognized-fields-from-authorization-response - [`13a9f34`](https://github.com/documenso/documenso/commit/13a9f34812d49d1f7a5f7a0a3fbe73e587f76724) fix: use reduce to create the linkAccount data ### 📊 Changes **1 file changed** (+32 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/lib/next-auth/auth-options.ts` (+32 -1) </details> ### 📄 Description --- name: Pull Request about: Submit changes to the project for review and inclusion --- ## Description In the context of OIDC: Some IDPs send additional fields in their authorization response. This leads to an error because these fields can't be persisted to the DB through auth.js prisma adapter. This PR solves this by deleting all unrecognized fields from the authorization response before persisting. This behaviour is also compliant to [RFC6749 Section 4.1.2](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2) (<-- OAuth2) ## Related Issue Addresses #1475 ## Changes Made - grab a list of all fields of the `Account` model - delete all other fields from the OAuth2 authorization response - hand the data back to auth.js prisma adapter ## Testing Performed - Tested that OIDC sign in works now with Keycloak, that sends the following additional fields in their authorization response: `refresh_expires_in` and `not-before-policy`. ## Checklist - [x] I have tested these changes locally and they work as expected. - [ ] I have added/updated tests that prove the effectiveness of these changes. - [ ] I have updated the documentation to reflect these changes, if applicable. - [x] I have followed the project's coding style guidelines. - [ ] I have addressed the code review feedback from the previous submission, if applicable. ## Additional Notes    ## Summary by CodeRabbit - **New Features** - Introduced a custom account linking method to enhance OAuth compliance. - Updated authentication options to utilize a refined adapter for better account management. - **Bug Fixes** - Improved filtering of unrecognized fields in the authorization response for more accurate account linking.  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-02-26 19:34:12 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#1659

No description provided.

Rows
Columns