sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-10-15 06:09:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

refactor: remove unused issuer check from refresh token API validation

Browse Source
This commit is contained in:
Elias Schneider
2026-10-13 22:34:51 +02:00
parent 0ffeb170cf
commit 03cab69d6b
1 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/oidc/token_handler.go
+4 -8
View File
@@ -117,12 +117,7 @@ func (h *tokenHandler) validateRefreshAPIGrant(ctx context.Context, client Clien
return nil
}
issuer := ""
if h.claimsService != nil {
issuer = h.claimsService.baseURL
}
resource, err := refreshGrantResource(client.GetID(), issuer, accessRequest.GetGrantedAudience())
resource, err := refreshGrantResource(client.GetID(), accessRequest.GetGrantedAudience())
if err != nil {
return err
}
@@ -131,10 +126,11 @@ func (h *tokenHandler) validateRefreshAPIGrant(ctx context.Context, client Clien
return err
}
func refreshGrantResource(clientID, issuer string, grantedAudience fosite.Arguments) (string, error) {
// refreshGrantResource recovers the API resource of a refresh grant from its granted audience
func refreshGrantResource(clientID string, grantedAudience fosite.Arguments) (string, error) {
resource := ""
for _, audience := range grantedAudience {
if audience == "" || audience == clientID || audience == issuer {
if audience == "" || audience == clientID {
continue
}
if resource != "" && resource != audience {