From 03fc844d055437e1391b29cdda0b28c8c94e6bdb Mon Sep 17 00:00:00 2001
From: Elias Schneider <git@eliasschneider.com>
Date: Fri, 9 Oct 2026 22:59:32 +0200
Subject: [PATCH] fix: only return minimal client metadata for public
 interaction endpoint

---
 .../internal/oidc/interaction_session_dto.go  | 22 +++++++++++++------
 frontend/src/lib/types/oidc.type.ts           |  7 +++++-
 .../components/client-provider-images.svelte  |  4 ++--
 3 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/backend/internal/oidc/interaction_session_dto.go b/backend/internal/oidc/interaction_session_dto.go
index a485c903..9680174c 100644
--- a/backend/internal/oidc/interaction_session_dto.go
+++ b/backend/internal/oidc/interaction_session_dto.go
@@ -14,12 +14,20 @@ const (
 )
 
 type interactionSessionForUser struct {
-	ID            string                    `json:"id"`
-	Scopes        []string                  `json:"scopes"`
-	ScopeInfo     []dto.ScopeInfoDto        `json:"scopeInfo"`
-	Client        dto.OidcClientMetaDataDto `json:"client"`
-	CurrentStep   interactionStep           `json:"currentStep,omitempty"`
-	RequiredSteps []interactionStep         `json:"requiredSteps"`
+	ID            string             `json:"id"`
+	Scopes        []string           `json:"scopes"`
+	ScopeInfo     []dto.ScopeInfoDto `json:"scopeInfo"`
+	Client        interactionClient  `json:"client"`
+	CurrentStep   interactionStep    `json:"currentStep,omitempty"`
+	RequiredSteps []interactionStep  `json:"requiredSteps"`
+}
+
+type interactionClient struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	HasLogo     bool   `json:"hasLogo"`
+	HasDarkLogo bool   `json:"hasDarkLogo"`
+	ClientType  string `json:"clientType"`
 }
 
 type completeInteractionRequest struct {
@@ -32,7 +40,7 @@ type completeInteractionResponse struct {
 }
 
 func newInteractionSessionForUser(interactionSession InteractionSession) (interactionSessionForUser, error) {
-	var client dto.OidcClientMetaDataDto
+	var client interactionClient
 	if err := dto.MapStruct(interactionSession.Client, &client); err != nil {
 		return interactionSessionForUser{}, err
 	}
diff --git a/frontend/src/lib/types/oidc.type.ts b/frontend/src/lib/types/oidc.type.ts
index 365220d3..9ef9f173 100644
--- a/frontend/src/lib/types/oidc.type.ts
+++ b/frontend/src/lib/types/oidc.type.ts
@@ -137,11 +137,16 @@ export type InteractionScopeInfo = {
 	description?: string;
 };
 
+export type InteractionClient = Pick<
+	OidcClientMetaData,
+	'id' | 'name' | 'hasLogo' | 'hasDarkLogo' | 'clientType'
+>;
+
 export type InteractionSession = {
 	id: string;
 	scopes: string[];
 	scopeInfo: InteractionScopeInfo[];
-	client: OidcClientMetaData;
+	client: InteractionClient;
 	currentStep?: InteractionStep;
 	requiredSteps: InteractionStep[];
 };
diff --git a/frontend/src/routes/authorize/components/client-provider-images.svelte b/frontend/src/routes/authorize/components/client-provider-images.svelte
index 43b82496..651dccfb 100644
--- a/frontend/src/routes/authorize/components/client-provider-images.svelte
+++ b/frontend/src/routes/authorize/components/client-provider-images.svelte
@@ -5,7 +5,7 @@
 	import CrossAnimated from '#lib/icons/cross-animated.svelte';
 	import { m } from '#lib/paraglide/messages.js';
 	import appConfigStore from '#lib/stores/application-configuration-store.ts';
-	import type { OidcClientMetaData } from '#lib/types/oidc.type.ts';
+	import type { InteractionClient } from '#lib/types/oidc.type.ts';
 	import { cachedOidcClientLogo } from '#lib/utils/cached-image-util.ts';
 	import { mode } from 'mode-watcher';
 	import { untrack } from 'svelte';
@@ -21,7 +21,7 @@
 	}: {
 		success?: boolean;
 		error?: boolean;
-		client?: OidcClientMetaData;
+		client?: InteractionClient;
 	} = $props();
 
 	// Each tile travels this far so they meet in the middle