fix: authenticate confidential clients on the OAuth2 refresh grant - #29207

Merged

BobbyHo merged 172 commits into

mainfrom

coder-plat-506-refresh-client-auth

Sep 15, 2026

Commits on Aug 14, 2026

feat(coderd/rbac): compare scopes by permission coverage
BobbyHo
committed
a672066

Commits on Aug 17, 2026

Merge branch 'main' into plat479-1-rbac-scope-coverage
BobbyHo
authored
4315706
docs(coderd/rbac): shorten the ScopesCover doc comment

BobbyHo
and
claude
committed
787c461

Commits on Aug 18, 2026

Merge branch 'main' into plat479-1-rbac-scope-coverage
BobbyHo
authored
2d39e04
fix(coderd/rbac): guard allowed-side org and user permissions

BobbyHo
and
claude
committed
2f6c44e
refactor(coderd/rbac): drop the unreachable negative skip in coverage
BobbyHo
committed
bd40270
test(coderd/rbac): pin the scope coverage table's weak assertions
BobbyHo
committed
3139c54
refactor(coderd/rbac): make the coverage guards reachable from tests
BobbyHo
committed
9276bb8
refactor(coderd/rbac): share the alias table and name the canonical contract
BobbyHo
committed
865eb9a
docs(coderd/rbac): document the expansion invariant where it can be broken
BobbyHo
committed
26a6bed

Commits on Aug 19, 2026

Merge branch 'main' into plat479-1-rbac-scope-coverage
BobbyHo
authored
7cca7b3
test(coderd/rbac): pin the coverage guards at one strength

BobbyHo
and
claude
committed
1678a77
fix(coderd/rbac): name the scope once in expansion errors

BobbyHo
and
claude
committed
aba3c6c
docs(coderd/rbac): correct the external scope list contract

BobbyHo
and
claude
committed
9a08105
docs(coderd/rbac): trim the restated coverage invariant

BobbyHo
and
claude
committed
2fcce8b
docs(coderd/rbac): correct the negative permission cross-reference
BobbyHo
committed
a775a48
docs(coderd/rbac): name every category IsExternalScope admits
BobbyHo
committed
e0c0d4a
test(coderd/rbac): pin the alias list invariants on the alias table
BobbyHo
committed
189740d
Merge branch 'main' into plat479-1-rbac-scope-coverage
BobbyHo
authored
7d08e49
feat(coderd/oauth2provider): negotiate and persist authorization scope
BobbyHo
committed
ca4dc52
feat(site): state the negotiated scope on the OAuth2 consent page
BobbyHo
committed
f402e1a
fix(coderd/oauth2provider): return invalid_scope to the client's callback
BobbyHo
committed
28ef5ba

Commits on Aug 20, 2026

Commits on Aug 21, 2026

Commits on Aug 22, 2026

Commits on Aug 23, 2026

Commits on Aug 25, 2026

Commits on Aug 26, 2026

Merge branch 'main' into plat479-2-negotiate-scope
BobbyHo
authored
78fbab1

Commits on Aug 28, 2026

Commits on Aug 29, 2026

feat: let an OAuth2 refresh narrow the granted scope
BobbyHo
committed
48cb5a4

Commits on Aug 31, 2026

Commits on Sep 1, 2026

Commits on Sep 2, 2026

Commits on Sep 3, 2026

test(coderd): cover replay and post-redemption state for single-use codes
BobbyHo
committed
d9d032d

Commits on Sep 4, 2026

Commits on Sep 5, 2026

Commits on Sep 6, 2026

Commits on Sep 9, 2026

Commits on Sep 10, 2026

Commits on Sep 11, 2026

Commits on Sep 14, 2026

Commits on Sep 15, 2026