Skip to content

v0.3.8 — OAuth2 token-endpoint authentication method

Choose a tag to compare

View all tags
@keysersoft keysersoft released this 29 Jul 07:15
· 25 commits to main since this release
v0.3.8
d30110f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Features

  • OAuth2 token-endpoint authentication method is now selectable (#452): some providers only accept client credentials as an HTTP Basic header at the token endpoint (client_secret_basic, RFC 6749 §2.3.1) and answer 401 to credentials sent in the request body. The engine has honoured tokenAuthMethod since v0.3.5 — for the authorization-code exchange and later refreshes — but it could only be set by hand-crafting authConfig, which made it effectively unreachable.

    The connector form now offers Token endpoint authentication on create and edit: client secret in body (default) or HTTP Basic header. Two endpoints back it:
    GET /api/connectors/:id/oauth-config Current non-secret settings. The client secret and issued tokens are never returned — only hasClientSecret / hasAccessToken / hasRefreshToken.
    PATCH /api/connectors/:id/oauth-config Partial update, merged into the existing authConfig.

    The PATCH merges rather than replaces on purpose: authConfig also holds the issued access/refresh tokens and the endpoints captured during authorization, so a full write would silently destroy a working authorization. Omitted fields keep their value; tokenAuthMethod: "" resets to the default.

    Reported by a user connecting Datto RMM (merlot-api.centrastage.net); DATEV requires the same. Verified read-only against Datto's token endpoint: credentials in the body return 401 with WWW-Authenticate: Basic realm="oauth2/client", while the Basic header passes client authentication.

Fixes

  • OAuth2 client credentials were never saved from the connector edit page (#452): the Client ID and Client Secret inputs were rendered but silently discarded — buildAuthConfig() had no OAUTH2 case and fell through to returning undefined. The placeholder even read "Leave empty to keep current", which made the no-op look intentional. They now persist through the merge endpoint.
  • The auth-method selector is pre-filled from the stored configuration; without that, saving any unrelated field would have silently reset a connector already configured for HTTP Basic.

Maintenance

Dependency updates across the Prisma, Sentry, Radix UI, Playwright, ESLint/Prettier and Jest groups, plus soap and next.

Upgrading

No schema changes and no configuration changes. Existing OAuth2 connectors keep their current behaviour; switch a connector to HTTP Basic only if its provider requires it, then re-run Authorize with Provider so a token is fetched the new way.

Verification: backend 3469 tests green (+12 covering merge semantics, the empty-body no-op, non-OAuth2 rejection, role enforcement, and that the GET leaks neither secret nor tokens), typecheck clean; frontend typecheck + build + e2e clean.

Docs: docs/connectors/rest.md — new Token endpoint authentication section with a Datto RMM example.

Assets 2
Loading