@@ -1091,56 +1091,56 @@ impl AuthorizationManager {
10911091 /// the client if credentials are found. Returns `false` when credentials
10921092 /// are absent or discarded after an authorization-server change.
10931093 pub async fn initialize_from_store ( & mut self ) -> Result < bool , AuthError > {
1094- if let Some ( stored) = self . credential_store . load ( ) . await ? {
1095- if stored. token_response . is_some ( ) {
1096- if self . metadata . is_none ( ) {
1097- let metadata = self . discover_metadata ( ) . await ?;
1098- self . metadata = Some ( metadata) ;
1099- }
1100-
1101- if let ( Some ( stored_issuer) , Some ( current_issuer) ) =
1102- ( stored. issuer . as_deref ( ) , self . metadata_issuer ( ) . as_deref ( ) )
1103- {
1104- // A CIMD client ID is the client's metadata URL, so it is
1105- // portable across authorization servers and exempt here.
1106- if stored_issuer != current_issuer {
1107- if is_https_url ( & stored. client_id ) {
1108- // A CIMD client ID is the client's metadata URL, so it is
1109- // portable across authorization servers — but the tokens
1110- // were minted by the previous AS and must not be reused.
1111- tracing:: warn!(
1112- stored_issuer,
1113- current_issuer,
1114- "authorization server issuer changed; discarding tokens but keeping portable CIMD client ID"
1115- ) ;
1116- self . credential_store
1117- . save (
1118- StoredCredentials :: new (
1119- stored. client_id . clone ( ) ,
1120- None ,
1121- vec ! [ ] ,
1122- None ,
1123- )
1124- . with_issuer ( self . metadata_issuer ( ) ) ,
1125- )
1126- . await ?;
1127- self . configure_client_id ( & stored. client_id ) ?;
1128- return Ok ( false ) ;
1129- }
1094+ if let Some ( stored) = self . credential_store . load ( ) . await ?
1095+ && stored. token_response . is_some ( )
1096+ {
1097+ if self . metadata . is_none ( ) {
1098+ let metadata = self . discover_metadata ( ) . await ?;
1099+ self . metadata = Some ( metadata) ;
1100+ }
11301101
1102+ if let ( Some ( stored_issuer) , Some ( current_issuer) ) =
1103+ ( stored. issuer . as_deref ( ) , self . metadata_issuer ( ) . as_deref ( ) )
1104+ {
1105+ // A CIMD client ID is the client's metadata URL, so it is
1106+ // portable across authorization servers and exempt here.
1107+ if stored_issuer != current_issuer {
1108+ if is_https_url ( & stored. client_id ) {
1109+ // A CIMD client ID is the client's metadata URL, so it is
1110+ // portable across authorization servers — but the tokens
1111+ // were minted by the previous AS and must not be reused.
11311112 tracing:: warn!(
11321113 stored_issuer,
11331114 current_issuer,
1134- "authorization server issuer changed; clearing stored credentials bound to the previous issuer "
1115+ "authorization server issuer changed; discarding tokens but keeping portable CIMD client ID "
11351116 ) ;
1136- self . credential_store . clear ( ) . await ?;
1117+ self . credential_store
1118+ . save (
1119+ StoredCredentials :: new (
1120+ stored. client_id . clone ( ) ,
1121+ None ,
1122+ vec ! [ ] ,
1123+ None ,
1124+ )
1125+ . with_issuer ( self . metadata_issuer ( ) ) ,
1126+ )
1127+ . await ?;
1128+ self . configure_client_id ( & stored. client_id ) ?;
11371129 return Ok ( false ) ;
11381130 }
1139- }
11401131
1141- self . configure_client_id ( & stored. client_id ) ?;
1142- return Ok ( true ) ;
1132+ tracing:: warn!(
1133+ stored_issuer,
1134+ current_issuer,
1135+ "authorization server issuer changed; clearing stored credentials bound to the previous issuer"
1136+ ) ;
1137+ self . credential_store . clear ( ) . await ?;
1138+ return Ok ( false ) ;
1139+ }
11431140 }
1141+
1142+ self . configure_client_id ( & stored. client_id ) ?;
1143+ return Ok ( true ) ;
11441144 }
11451145 Ok ( false )
11461146 }
@@ -1268,10 +1268,10 @@ impl AuthorizationManager {
12681268
12691269 // RFC 8414 RECOMMENDS response_types_supported in the metadata. This field is optional,
12701270 // but if present and does not include the flow we use ("code"), bail out early with a clear error.
1271- if let Some ( response_types_supported) = metadata. response_types_supported . as_ref ( ) {
1272- if !response_types_supported. contains ( & response_type. to_string ( ) ) {
1273- return Err ( AuthError :: InvalidScope ( response_type . to_string ( ) ) ) ;
1274- }
1271+ if let Some ( response_types_supported) = metadata. response_types_supported . as_ref ( )
1272+ && !response_types_supported. contains ( & response_type. to_string ( ) )
1273+ {
1274+ return Err ( AuthError :: InvalidScope ( response_type . to_string ( ) ) ) ;
12751275 }
12761276
12771277 // The client always sends an S256 challenge. A server that advertises
@@ -1556,12 +1556,11 @@ impl AuthorizationManager {
15561556 }
15571557
15581558 // nothing requested or challenged yet: seed from AS metadata, then caller defaults
1559- if let Some ( metadata) = & self . metadata {
1560- if let Some ( scopes_supported) = & metadata. scopes_supported {
1561- if !scopes_supported. is_empty ( ) {
1562- return scopes_supported. clone ( ) ;
1563- }
1564- }
1559+ if let Some ( metadata) = & self . metadata
1560+ && let Some ( scopes_supported) = & metadata. scopes_supported
1561+ && !scopes_supported. is_empty ( )
1562+ {
1563+ return scopes_supported. clone ( ) ;
15651564 }
15661565
15671566 default_scopes. iter ( ) . map ( |s| s. to_string ( ) ) . collect ( )
@@ -1573,12 +1572,11 @@ impl AuthorizationManager {
15731572 if scopes. is_empty ( ) || scopes. iter ( ) . any ( |s| s == "offline_access" ) {
15741573 return ;
15751574 }
1576- if let Some ( metadata) = & self . metadata {
1577- if let Some ( supported) = & metadata. scopes_supported {
1578- if supported. iter ( ) . any ( |s| s == "offline_access" ) {
1579- scopes. push ( "offline_access" . to_string ( ) ) ;
1580- }
1581- }
1575+ if let Some ( metadata) = & self . metadata
1576+ && let Some ( supported) = & metadata. scopes_supported
1577+ && supported. iter ( ) . any ( |s| s == "offline_access" )
1578+ {
1579+ scopes. push ( "offline_access" . to_string ( ) ) ;
15821580 }
15831581 }
15841582
@@ -2098,10 +2096,10 @@ impl AuthorizationManager {
20982096 self . validate_resource_metadata_resource ( & resource_metadata) ?;
20992097
21002098 // store scopes_supported from protected resource metadata for select_scopes()
2101- if let Some ( scopes) = resource_metadata. scopes_supported {
2102- if !scopes. is_empty ( ) {
2103- * self . resource_scopes . write ( ) . await = scopes ;
2104- }
2099+ if let Some ( scopes) = resource_metadata. scopes_supported
2100+ && !scopes. is_empty ( )
2101+ {
2102+ * self . resource_scopes . write ( ) . await = scopes ;
21052103 }
21062104
21072105 let mut candidates = Vec :: new ( ) ;
@@ -2544,20 +2542,18 @@ impl AuthorizationManager {
25442542 if let ClientCredentialsConfig :: PrivateKeyJwt {
25452543 signing_algorithm, ..
25462544 } = config
2547- {
2548- if let Some ( algs) = metadata
2545+ && let Some ( algs) = metadata
25492546 . additional_fields
25502547 . get ( "token_endpoint_auth_signing_alg_values_supported" )
25512548 . and_then ( |v| v. as_array ( ) )
2552- {
2553- let alg_str = signing_algorithm. as_str ( ) ;
2554- if !algs. iter ( ) . any ( |a| a. as_str ( ) == Some ( alg_str) ) {
2555- let supported: Vec < & str > = algs. iter ( ) . filter_map ( |a| a. as_str ( ) ) . collect ( ) ;
2556- return Err ( AuthError :: ClientCredentialsError ( format ! (
2557- "Authorization server does not support signing algorithm '{}'. Supported: {:?}" ,
2558- alg_str, supported
2559- ) ) ) ;
2560- }
2549+ {
2550+ let alg_str = signing_algorithm. as_str ( ) ;
2551+ if !algs. iter ( ) . any ( |a| a. as_str ( ) == Some ( alg_str) ) {
2552+ let supported: Vec < & str > = algs. iter ( ) . filter_map ( |a| a. as_str ( ) ) . collect ( ) ;
2553+ return Err ( AuthError :: ClientCredentialsError ( format ! (
2554+ "Authorization server does not support signing algorithm '{}'. Supported: {:?}" ,
2555+ alg_str, supported
2556+ ) ) ) ;
25612557 }
25622558 }
25632559
0 commit comments