sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-08-31 08:11:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Remove deprecated method

Browse Source
This commit is contained in:
ItalyPaleAle
2026-08-09 17:55:44 -07:00
parent 379be0dbbc
commit b1f072463e
3 changed files with 1 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
backend/internal/controller/oidc_controller.go
View File

@@ -34,7 +34,6 @@ func NewOidcController(group *gin.RouterGroup, authMiddleware *middleware.AuthMi
group.DELETE("/oidc/clients/:id", authMiddleware.Add(), httpserver.Handle(oc.deleteClientHandler))
group.PUT("/oidc/clients/:id/allowed-user-groups", authMiddleware.Add(), httpserver.Handle(oc.updateAllowedUserGroupsHandler))
group.POST("/oidc/clients/:id/secret", authMiddleware.Add(), httpserver.Handle(oc.replaceClientSecretHandler))
group.GET("/oidc/clients/:id/secrets", authMiddleware.Add(), httpserver.Handle(oc.listClientSecretsHandler))
group.POST("/oidc/clients/:id/secrets", authMiddleware.Add(), httpserver.Handle(oc.createClientSecretHandler))
group.DELETE("/oidc/clients/:id/secrets/:secretId", authMiddleware.Add(), httpserver.Handle(oc.deleteClientSecretHandler))
@@ -258,32 +257,6 @@ func (oc *OidcController) refreshClientMetadataHandler(c *gin.Context) error {
return nil
}
// replaceClientSecretHandler godoc
// @Summary Replace client secrets
// @Description Set or generate a new secret for an OIDC client, removing all of its existing secrets. Deprecated: use POST /api/oidc/clients/{id}/secrets to add a secret without invalidating the existing ones.
// @Tags OIDC
// @Accept json
// @Produce json
// @Param id path string true "Client ID"
// @Param payload body dto.OidcClientSecretCreateDto false "Client secret"
// @Success 200 {object} object "{ \"secret\": \"string\" }"
// @Deprecated true
// @Router /api/oidc/clients/{id}/secret [post]
func (oc *OidcController) replaceClientSecretHandler(c *gin.Context) error {
var input dto.OidcClientSecretCreateDto
if err := httpserver.BindOptionalJSON(c, &input); err != nil {
return err
}
_, secret, err := oc.oidcService.ReplaceClientSecrets(c.Request.Context(), c.Param("id"), input)
if err != nil {
return err
}
c.JSON(http.StatusOK, gin.H{"secret": secret})
return nil
}
// listClientSecretsHandler godoc
// @Summary List client secrets
// @Description List the secrets of an OIDC client, without disclosing their values

14
backend/internal/service/oidc_service.go
View File

@@ -333,16 +333,6 @@ func (s *OidcService) ListClientSecrets(ctx context.Context, clientID string) ([
// CreateClientSecret adds a new secret to a client and returns both the stored record and the secret's value, which is not recoverable afterwards
func (s *OidcService) CreateClientSecret(ctx context.Context, clientID string, input dto.OidcClientSecretCreateDto) (model.OidcClientSecret, string, error) {
return s.createClientSecretInternal(ctx, clientID, input, false)
}
// ReplaceClientSecrets removes every existing secret of a client and creates a new one
// It backs the deprecated single-secret endpoint, whose documented behavior is that creating a secret invalidates the previous one
func (s *OidcService) ReplaceClientSecrets(ctx context.Context, clientID string, input dto.OidcClientSecretCreateDto) (model.OidcClientSecret, string, error) {
return s.createClientSecretInternal(ctx, clientID, input, true)
}
func (s *OidcService) createClientSecretInternal(ctx context.Context, clientID string, input dto.OidcClientSecretCreateDto, replaceExisting bool) (model.OidcClientSecret, string, error) {
// An expiration date in the past would create a secret that can never be used
if input.ExpiresAt != nil && !input.ExpiresAt.ToTime().After(time.Now()) {
return model.OidcClientSecret{}, "", apperror.ValidationMessage("The expiration date of a client secret must be in the future")
@@ -362,9 +352,7 @@ func (s *OidcService) createClientSecretInternal(ctx context.Context, clientID s
return model.OidcClientSecret{}, "", apperror.ValidationMessage("Cannot create a secret for a public client")
}
if replaceExisting {
client.Credentials.Secrets = nil
} else if len(client.Credentials.Secrets) >= model.MaxOidcClientSecrets {
if len(client.Credentials.Secrets) >= model.MaxOidcClientSecrets {
return model.OidcClientSecret{}, "", apperror.ValidationMessage(fmt.Sprintf("A client cannot have more than %d secrets", model.MaxOidcClientSecrets))
}

8
backend/internal/service/oidc_service_test.go
View File

@@ -755,14 +755,6 @@ func TestOidcService_CreateClientSecret_limit(t *testing.T) {
_, _, err = s.CreateClientSecret(t.Context(), client.ID, dto.OidcClientSecretCreateDto{})
require.Error(t, err)
// The deprecated endpoint replaces every existing secret with a single new one
_, _, err = s.ReplaceClientSecrets(t.Context(), client.ID, dto.OidcClientSecretCreateDto{})
require.NoError(t, err)
secrets, err := s.ListClientSecrets(t.Context(), client.ID)
require.NoError(t, err)
assert.Len(t, secrets, 1)
}
func TestOidcService_CreateClientSecret_preservesFederatedIdentities(t *testing.T) {