Sync from monorepo fb44388a5e35

Author: FusionAuth Automation

src/main/java/io/fusionauth/domain/jwt/RefreshToken.java

@@ -15,10 +15,13 @@
  */
 package io.fusionauth.domain.jwt;
 
+import java.net.URI;
 import java.time.ZoneOffset;
 import java.time.ZonedDateTime;
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
@@ -151,6 +154,8 @@ public static class MetaData implements Buildable<MetaData> {
 
     public DeviceInfo device = new DeviceInfo();
 
+    public List<URI> resources;
+
     @JsonDeserialize(as = LinkedHashSet.class)
     public Set<String> scopes;
 
@@ -163,6 +168,9 @@ public MetaData(MetaData other) {
         this.data = new LinkedHashMap<>(other.data);
       }
       this.device = new DeviceInfo(other.device);
+      if (other.resources != null) {
+        this.resources = new ArrayList<>(other.resources);
+      }
       if (other.scopes != null) {
         this.scopes = new LinkedHashSet<>(other.scopes);
       }
@@ -179,12 +187,13 @@ public boolean equals(Object o) {
       MetaData metaData = (MetaData) o;
       return Objects.equals(data, metaData.data) &&
              Objects.equals(device, metaData.device) &&
+             Objects.equals(resources, metaData.resources) &&
              Objects.equals(scopes, metaData.scopes);
     }
 
     @Override
     public int hashCode() {
-      return Objects.hash(data, device, scopes);
+      return Objects.hash(data, device, resources, scopes);
     }
 
     @Override

src/main/java/io/fusionauth/domain/oauth2/OAuth2Configuration.java

@@ -42,6 +42,9 @@ public class OAuth2Configuration implements Buildable<OAuth2Configuration> {
   @JsonMerge(OptBoolean.FALSE)
   public List<URI> authorizedRedirectURLs = new ArrayList<>();
 
+  @JsonMerge(OptBoolean.FALSE)
+  public List<URI> authorizedResourceUris = new ArrayList<>();
+
   public Oauth2AuthorizedURLValidationPolicy authorizedURLValidationPolicy = Oauth2AuthorizedURLValidationPolicy.ExactMatch;
 
   public ClientAuthenticationPolicy clientAuthenticationPolicy;
@@ -94,6 +97,7 @@ public OAuth2Configuration() {
   public OAuth2Configuration(OAuth2Configuration other) {
     this.authorizedOriginURLs.addAll(other.authorizedOriginURLs);
     this.authorizedRedirectURLs.addAll(other.authorizedRedirectURLs);
+    this.authorizedResourceUris.addAll(other.authorizedResourceUris);
     this.authorizedURLValidationPolicy = other.authorizedURLValidationPolicy;
     this.clientAuthenticationPolicy = other.clientAuthenticationPolicy;
     this.clientId = other.clientId;
@@ -134,6 +138,7 @@ public boolean equals(Object o) {
            requireRegistration == that.requireRegistration &&
            Objects.equals(authorizedOriginURLs, that.authorizedOriginURLs) &&
            Objects.equals(authorizedRedirectURLs, that.authorizedRedirectURLs) &&
+           Objects.equals(authorizedResourceUris, that.authorizedResourceUris) &&
            Objects.equals(authorizedURLValidationPolicy, that.authorizedURLValidationPolicy) &&
            Objects.equals(clientAuthenticationPolicy, that.clientAuthenticationPolicy) &&
            Objects.equals(clientId, that.clientId) &&
@@ -163,12 +168,13 @@ public URI getFirstAuthorizedRedirectURLIgnoringPatterns() {
 
   @Override
   public int hashCode() {
-    return Objects.hash(authorizedOriginURLs, authorizedRedirectURLs, authorizedURLValidationPolicy, clientAuthenticationPolicy, clientId, clientSecret, consentMode, debug, deviceVerificationURL, enabledGrants, generateRefreshTokens, logoutBehavior, logoutURL, providedScopePolicy, proofKeyForCodeExchangePolicy, relationship, requireClientAuthentication, requireRegistration, scopeHandlingPolicy, unknownScopePolicy);
+    return Objects.hash(authorizedOriginURLs, authorizedRedirectURLs, authorizedResourceUris, authorizedURLValidationPolicy, clientAuthenticationPolicy, clientId, clientSecret, consentMode, debug, deviceVerificationURL, enabledGrants, generateRefreshTokens, logoutBehavior, logoutURL, providedScopePolicy, proofKeyForCodeExchangePolicy, relationship, requireClientAuthentication, requireRegistration, scopeHandlingPolicy, unknownScopePolicy);
   }
 
   public void normalize() {
     removeEmpty(authorizedOriginURLs);
     removeEmpty(authorizedRedirectURLs);
+    removeEmpty(authorizedResourceUris);
     clientId = trim(clientId);
     clientSecret = trim(clientSecret);
   }

src/main/java/io/fusionauth/domain/oauth2/OAuthError.java

@@ -105,7 +105,6 @@ public enum OAuthErrorReason {
     invalid_entity_permission_scope,
     invalid_user_id,
     invalid_tenant_id,
-
     // Grant disabled
     grant_type_disabled,
 
@@ -199,6 +198,10 @@ public enum OAuthErrorType {
 
     // RFC 9449 DPoP Proof of Possession. Section 12.2
     // https://datatracker.ietf.org/doc/html/rfc9449
-    invalid_dpop_proof
+    invalid_dpop_proof,
+
+    // RFC 8707 Resource Indicators
+    // https://datatracker.ietf.org/doc/html/rfc8707
+    invalid_target
   }
 }