Implement redirect URL autodiscovery (Trust On First Use - if none are manually defined).

2026-02-16 20:32:11 +00:00
parent 0081cc835b
commit 09049d3094
1 changed files with 11 additions and 1 deletions
@@ -125,7 +125,17 @@ async def websocket_authenticate(
            await ws.send_json({"status": 400, "detail": "Unknown client_id"})
            return

-        if redirect_uri not in oidc_client.redirect_uris:
+        # Redirect URI autodiscovery: if no URIs are defined, store the first one
+        if not oidc_client.redirect_uris:
+            # Basic validation: must be an HTTP(S) URL
+            if not redirect_uri.startswith(("http://", "https://")):
+                await ws.send_json({"status": 400, "detail": "Invalid redirect_uri"})
+                return
+            # Store as the only allowed redirect URI
+            db.update_oid_client(client_uuid, redirect_uris=[redirect_uri])
+            # Reload client to get updated redirect_uris
+            oidc_client = db.data().oid_clients.get(client_uuid)
+        elif redirect_uri not in oidc_client.redirect_uris:
            await ws.send_json({"status": 400, "detail": "Invalid redirect_uri"})
            return