feat: support token exchange grant type with app-level control #8145
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
xiaoyijun
requested review from
charIeszhao,
gao-sun,
simeng-li and
wangsijie
as code owners
COMPARE TO
|
| Name | Diff |
|---|---|
| .changeset/hungry-goats-itch.md | 📈 +742 Bytes |
| packages/console/src/consts/external-links.ts | 📈 +67 Bytes |
| packages/console/src/pages/ApplicationDetails/ApplicationDetailsContent/TokenExchangeSettings.tsx | 📈 +2.44 KB |
| packages/console/src/pages/ApplicationDetails/ApplicationDetailsContent/index.tsx | 📈 +111 Bytes |
| packages/core/src/oidc/application.ts | 📈 +1.27 KB |
| packages/core/src/oidc/grants/token-exchange/index.test.ts | 📈 +105 Bytes |
| packages/core/src/oidc/grants/token-exchange/index.ts | 📈 +28 Bytes |
| packages/core/src/oidc/utils.test.ts | 📈 +25 Bytes |
| packages/core/src/oidc/utils.ts | 📈 +721 Bytes |
| packages/core/src/routes/applications/application.test.ts | 📈 +342 Bytes |
| packages/core/src/routes/applications/application.ts | 📈 +618 Bytes |
| packages/integration-tests/src/tests/api/oidc/token-exchange/index.test.ts | 📈 +3.61 KB |
| packages/phrases/src/locales/ar/errors/application.ts | 📈 +192 Bytes |
| packages/phrases/src/locales/ar/translation/admin-console/application-details.ts | 📈 +982 Bytes |
| packages/phrases/src/locales/de/errors/application.ts | 📈 +134 Bytes |
| packages/phrases/src/locales/de/translation/admin-console/application-details.ts | 📈 +759 Bytes |
| packages/phrases/src/locales/en/errors/application.ts | 📈 +130 Bytes |
| packages/phrases/src/locales/en/translation/admin-console/application-details.ts | 📈 +664 Bytes |
| packages/phrases/src/locales/es/errors/application.ts | 📈 +138 Bytes |
| packages/phrases/src/locales/es/translation/admin-console/application-details.ts | 📈 +804 Bytes |
| packages/phrases/src/locales/fr/errors/application.ts | 📈 +147 Bytes |
| packages/phrases/src/locales/fr/translation/admin-console/application-details.ts | 📈 +816 Bytes |
| packages/phrases/src/locales/it/errors/application.ts | 📈 +137 Bytes |
| packages/phrases/src/locales/it/translation/admin-console/application-details.ts | 📈 +779 Bytes |
| packages/phrases/src/locales/ja/errors/application.ts | 📈 +163 Bytes |
| packages/phrases/src/locales/ja/translation/admin-console/application-details.ts | 📈 +928 Bytes |
| packages/phrases/src/locales/ko/errors/application.ts | 📈 +152 Bytes |
| packages/phrases/src/locales/ko/translation/admin-console/application-details.ts | 📈 +792 Bytes |
| packages/phrases/src/locales/pl-pl/errors/application.ts | 📈 +126 Bytes |
| packages/phrases/src/locales/pl-pl/translation/admin-console/application-details.ts | 📈 +748 Bytes |
| packages/phrases/src/locales/pt-br/errors/application.ts | 📈 +128 Bytes |
| packages/phrases/src/locales/pt-br/translation/admin-console/application-details.ts | 📈 +757 Bytes |
| packages/phrases/src/locales/pt-pt/errors/application.ts | 📈 +126 Bytes |
| packages/phrases/src/locales/pt-pt/translation/admin-console/application-details.ts | 📈 +755 Bytes |
| packages/phrases/src/locales/ru/errors/application.ts | 📈 +163 Bytes |
| packages/phrases/src/locales/ru/translation/admin-console/application-details.ts | 📈 +1.04 KB |
| packages/phrases/src/locales/th/errors/application.ts | 📈 +259 Bytes |
| packages/phrases/src/locales/th/translation/admin-console/application-details.ts | 📈 +1.36 KB |
| packages/phrases/src/locales/tr-tr/errors/application.ts | 📈 +131 Bytes |
| packages/phrases/src/locales/tr-tr/translation/admin-console/application-details.ts | 📈 +748 Bytes |
| packages/phrases/src/locales/zh-cn/errors/application.ts | 📈 +111 Bytes |
| packages/phrases/src/locales/zh-cn/translation/admin-console/application-details.ts | 📈 +596 Bytes |
| packages/phrases/src/locales/zh-hk/errors/application.ts | 📈 +111 Bytes |
| packages/phrases/src/locales/zh-hk/translation/admin-console/application-details.ts | 📈 +598 Bytes |
| packages/phrases/src/locales/zh-tw/errors/application.ts | 📈 +111 Bytes |
| packages/phrases/src/locales/zh-tw/translation/admin-console/application-details.ts | 📈 +598 Bytes |
| packages/schemas/alterations/next-1767193412-allow-token-exchange.ts | 📈 +787 Bytes |
| packages/schemas/src/foundations/jsonb-types/oidc-module.ts | 📈 +418 Bytes |
| packages/schemas/src/seeds/application.ts | 📈 +376 Bytes |
| packages/schemas/src/types/mapi-proxy.ts | 📈 +67 Bytes |
xiaoyijun
changed the title
wangsijie
reviewed
Jan 1, 2026
|
|
||
| - Add `allowTokenExchange` field to `customClientMetadata` to control whether an application can initiate token exchange requests | ||
| - Existing first-party applications will have this enabled by default (via database alteration) | ||
| - New M2M and Traditional Web applications will have this enabled by default |
Contributor
There was a problem hiding this comment.
Maybe we can make it disabled by default
|
|
||
| // Third-party applications are not allowed to perform token exchange | ||
| if (application?.isThirdParty) { | ||
| return 'third-party applications are not allowed for this grant type'; |
Contributor
There was a problem hiding this comment.
Do we have i18n support for oidc error messages?
Contributor
Author
There was a problem hiding this comment.
Aligned with existing OIDC error messages in the codebase. These are developer-facing, not end-user-facing. So keeping it in English is fine here.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds application-level control for the token exchange grant type:
allowTokenExchangefield tocustomClientMetadatato control whether an application can initiate token exchange requestsTodo
oidc/folder (unrelated to this PR, will be done separately)Testing
Checklist
.changeset