Add RFC 9396 Rich Authorization Requests support - #171
Merged
Conversation
- Central: register/update/delete authorization detail types per tenant, each backed by a JSON Schema (2020-12); synced to auth via the existing polling ReloadingCache pattern, with Postgres NOTIFY-based cache invalidation on the central side. - Auth: parse and validate authorization_details on /authorize and /par (RFC 9126 integration) against the registered schema; reject unknown types and schema violations. Support resource://edge locations, validated the same way as the resource parameter. - Persist authorization_details as a nullable column across conversation, authorization code, and refresh token records/repositories, so an absent parameter (NULL) is distinguishable from an empty request. - JsonSchemaValidator: cache compiled schemas by canonical schema text, bounded to avoid unbounded growth from repeated schema edits; lookups use a lock-free ConcurrentHashMap, with the bound enforced only on the miss path. - central-ui: management screens for authorization detail types. - e2e: happy path, unregistered type, and invalid schema registration coverage, including the PAR flow.
versola-navigation's :host was position: fixed with height: 100vh. That keeps it correctly pinned to the viewport during real scrolling, but caps its own height at one viewport regardless of the document's actual height. A tool that captures the whole scrollable page in one shot (full page screenshot, print/PDF) then renders one viewport's worth of sidebar followed by flat background for the rest of a taller document \u2014 visible on any screen whose content pushes the page past the fold, e.g. resources' "Add endpoint" panel. Split the sizing and pinning responsibilities instead: :host is now a plain flex sizer stretched to the row's full height by admin-app's .app-layout (now display: flex), while the actual viewport-pinned panel is an inner .nav-panel (position: sticky, height: 100vh). The mobile off-canvas drawer, which is genuinely meant to be exactly one viewport tall, keeps the previous fixed-positioning approach on :host directly. Verified via Playwright: sidebar sizer now spans the full document height on a tall resources form, nav content still stays pinned during real-viewport scrolling, and the mobile drawer still opens/closes off-canvas without shifting main content width. Full existing suite: 106/108 passing (the 2 failures reproduce identically on unmodified main, unrelated to this change).
…n-details # Conflicts: # auth/implementations/postgres/src/main/scala/versola/oauth/conversation/PostgresConversationRepository.scala # auth/src/main/scala/versola/oauth/authorize/AuthorizeRequestParser.scala # auth/src/main/scala/versola/oauth/authorize/model/AuthorizeRequest.scala # auth/src/main/scala/versola/oauth/conversation/model/ConversationRecord.scala # auth/src/main/scala/versola/oauth/token/OAuthTokenService.scala # auth/src/test/scala/versola/oauth/token/OAuthTokenServiceSpec.scala # central/src/main/scala/versola/central/configuration/dto.scala # e2e/src/test/scala/versola/e2e/support/OAuthClient.scala
… and unused verifier binding
goshacodes
marked this pull request as ready for review
August 15, 2026 15:19
Member
Author
|
augment review |
Contributor
🤖 Augment PR SummarySummary: Adds end-to-end RFC 9396 Rich Authorization Requests support. Changes:
🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements RFC 9396 (Rich Authorization Requests) end to end:
authvia the existing pollingReloadingCachepattern; PostgresNOTIFY-based cache invalidation on the central side (authorization_detail_type_change).authorization_detailson/authorizeand/par(RFC 9126 integration). Rejects unknown types and schema violations.resource://edgeis supported as a location, validated the same way as theresourceparameter (and rejected when mixed with internal resources).authorization_detailsstored as a nullable column across conversation, authorization code, and refresh token records/repositories, so an absent parameter (NULL) is distinguishable from an explicit empty request.ConcurrentHashMap); the size bound is enforced only on the miss path (schema registration/edit), which keeps the hot validate() path free of locking.Testing
central+auth(Postgres-backed).Notes
authorization_detailscolumns are nullable with no default, to distinguish "no details requested" from "empty details requested".validateSchema(meta-schema structural check) at registration time, andvalidate(compile + validate) lazily on first use at authorize/PAR time, with the result cached thereafter.Pull Request opened by Augment Code | View session