Infrastructure/logto
0
Fork 0
mirror of https://github.com/logto-io/logto.git synced 2025-02-17 22:04:19 -05:00
Code Issues Activity

fix(core): remove the requirement of secured app for PAT (#6493)

Browse source
This commit is contained in:
wangsijie 2024-08-22 13:54:47 +08:00 • committed by GitHub
parent c51f3c5644
commit 2ebc47170e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 1 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
packages/core/src/oidc/grants/token-exchange/index.ts
View file

@ -25,7 +25,7 @@ import { handleClientCertificate, handleDPoP, checkOrganizationAccess } from '..
import { validateSubjectToken } from './account.js';
import { handleActorToken } from './actor-token.js';
import { TokenExchangeTokenType, type TokenExchangeAct } from './types.js';
import { type TokenExchangeAct } from './types.js';
const { InvalidClient, InvalidGrant } = errors;
@ -67,12 +67,6 @@ export const buildHandler: (
!(await isThirdPartyApplication(queries, client.clientId)),
new InvalidClient('third-party applications are not allowed for this grant type')
);
// Personal access tokens require secured client
assertThat(
params.subject_token_type !== TokenExchangeTokenType.PersonalAccessToken ||
client.tokenEndpointAuthMethod === 'client_secret_basic',
new InvalidClient('third-party applications are not allowed for this grant type')
);
validatePresence(ctx, ...requiredParameters);

14
packages/integration-tests/src/tests/api/oidc/token-exchange/personal-access-token.test.ts
View file

@ -140,20 +140,6 @@ describe('Token Exchange (Personal Access Token)', () => {
expect(payload).toHaveProperty('sub', testUserId);
});
it('should fail with non-secure client authentication method', async () => {
await expect(
oidcApi.post('token', {
headers: formUrlEncodedHeaders,
body: new URLSearchParams({
client_id: testApiResourceId,
grant_type: GrantType.TokenExchange,
subject_token: testToken,
subject_token_type: tokenType,
}),
})
).rejects.toThrow();
});
it('should fail with invalid PAT', async () => {
await expect(
oidcApi.post('token', {