mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-09 02:12:59 +00:00
Anso
e084ad424c
* fix(sso): forward RFC 9207 iss parameter in OIDC callback The Custom OIDC callback only forwarded code and state from the query string to the token exchange, silently dropping the iss parameter that issuer-identification-aware providers (Keycloak 22+, and others) add to the redirect. openid-client rejects the exchange as an invalid response once discovery advertises support for that parameter, so login failed for any such provider. * fix(sso): forward RFC 9207 iss parameter in OIDC callback The Custom OIDC callback only forwarded code and state from the query string to the token exchange, silently dropping the iss parameter that issuer-identification-aware providers add to the redirect. openid-client rejects the exchange as an invalid response once discovery advertises support for that parameter (confirmed on Keycloak 26), so login failed for any such provider. Also logs the underlying openid-client error cause on callback failure instead of only the generic message it collapses specific validation errors into, since that cause carries the actual diagnosis. * refactor(sso): dedupe iss-forwarding test setup Extracts the shared callback-with-stubbed-service setup used by both new regression tests into one helper.