comparison mod_http_oauth2/mod_http_oauth2.lua @ 5365:698fef74ce53

mod_http_oauth2: Allow only l10n variants of name in client metadata Since "client_name" seems to be the only human readable non-URI property that makes sense to have localized version of. Therefore it seems excessive to allow arbitrary additionalProperties. We don't make use of localized versions of client_name and URIs yet, but it would be nice to do so.
author Kim Alvefur <zash@zash.se>
date Tue, 25 Apr 2023 17:38:36 +0200
parents 0444953e3247
children db4c66a1d24b
comparison
equal deleted inserted replaced
5364:0444953e3247 5365:698fef74ce53
667 jwks_uri = { type = "string"; format = "uri"; luaPattern = "^https:" }; 667 jwks_uri = { type = "string"; format = "uri"; luaPattern = "^https:" };
668 jwks = { type = "object"; description = "JSON Web Key Set, RFC 7517" }; 668 jwks = { type = "object"; description = "JSON Web Key Set, RFC 7517" };
669 software_id = { type = "string"; format = "uuid" }; 669 software_id = { type = "string"; format = "uuid" };
670 software_version = { type = "string" }; 670 software_version = { type = "string" };
671 }; 671 };
672 -- Localized versions of descriptive properties and URIs 672 luaPatternProperties = {
673 luaPatternProperties = { ["^[a-z_]+_uri#"] = { type = "string"; format = "uri"; luaPattern = "^https:" } }; 673 -- Localized versions of descriptive properties and URIs
674 additionalProperties = { type = "string" }; 674 ["^client_name#"] = { description = "Localized version of 'client_name'"; type = "string" };
675 ["^[a-z_]+_uri#"] = { type = "string"; format = "uri"; luaPattern = "^https:" };
676 };
675 } 677 }
676 678
677 function create_client(client_metadata) 679 function create_client(client_metadata)
678 if not schema.validate(registration_schema, client_metadata) then 680 if not schema.validate(registration_schema, client_metadata) then
679 return nil, oauth_error("invalid_request", "Failed schema validation."); 681 return nil, oauth_error("invalid_request", "Failed schema validation.");