Files
1b45023dba fix(admin): source scoping + redirect URIs in admin OAuth registration
Takeover of #1558 (rebased onto master, admin/dist + admin-embedded
regenerated so asset hashes match; source changes salvaged intact):

- /admin/api/register-client now accepts source_id + federated_read
  (snake and camel case), validated fail-closed against the registered
  source list via the new normalizeAdminClientSourceScope
  (src/core/admin-source-scope.ts) before reaching
  registerClientManual — unknown or malformed ids are a 400, never a
  silently-hardcoded 'default'. Fixes #1490.
- New requireAdmin-gated GET /admin/api/sources feeds the Register
  Agent form; the form now has a Write Source select + Read Sources
  checkboxes, and the agents table/drawer show each client's scope.
- #1036: the Register Agent form now has a Redirect URIs textarea
  (one per line). When present, the POST carries redirectUris plus
  the authorization_code + refresh_token grants, mirroring the CLI's
  --redirect-uri grant-inference convention (src/commands/auth.ts).
  Backend plumbing already existed; this was UI-only.

Tests: test/admin-source-scope.test.ts (normalization matrix),
test/oauth.test.ts (registerClientManual persists source scope into
AuthInfo), test/fix-wave-structural.test.ts (endpoint + form pins for
#1490 and #1036).

Co-authored-by: flamerged <flamerged@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-21 15:09:32 -07:00
..