Replace experimental jwt-bearer client flag with a grant-types-enabled config
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 52/100
- Issue 类型
- 重构
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- go
- 领域
- api, authentication
调研方向
从 auth/cmd 和 auth/config.go 开始，追踪新 grant-types-enabled 设置的注册和加载，然后继续跟踪 OpenID4VPClient 和 AuthorizationServerMetadata 的构造。更新受影响的测试、server_options.rst 和发布说明；完成的标准是启用的集合同时控制客户端行为和公布的 grant_types_supported，并移除旧 flag。
由索引模型根据 Issue 内容生成。
描述
Background
PR #4227 added auth.experimental.jwt_bearer_client (bool, default false) to gate the new RFC 7523 jwt-bearer two-VP client flow. During review @reinkrul suggested replacing it with a list-style config so the same mechanism can later enable/disable other grant types (authorization_code, vp_token-bearer, openid4vp, etc.).
We agreed to defer the refactor (rather than do it inside #4227) because doing it properly means touching every grant type that we currently support unconditionally, not just the new one.
Proposed change
Introduce a list-style config:
auth.granttypesenabled: [authorization_code, urn:ietf:params:oauth:grant-type:vp_token-bearer]
- Default: the grant types we currently support without a flag (
authorization_code,vp_token-bearer). - Operators opt into the experimental two-VP flow by appending
urn:ietf:params:oauth:grant-type:jwt-bearer. - Drop
auth.Config.Experimental.JwtBearerClientonce the new config is in place.
Knock-on: AS metadata advertisement
The same config should drive what the local Authorization Server advertises in its metadata under grant_types_supported. Today the metadata is built from a fixed list; once the config exists, the metadata builder must read from it so AS clients can negotiate correctly.
This is the main reason we deferred the refactor out of #4227: the metadata thread reaches further than the client-side gate, and doing it half-way would hide the change from any peer node fetching our AS metadata.
Scope
- New config field + flag registration in `auth/cmd` and `auth/config.go`.
- Replace the `OpenID4VPClient.experimentalJwtBearerClient bool` with a membership check against the enabled set.
- Wire the same set into `AuthorizationServerMetadata.GrantTypesSupported` construction.
- Migrate / remove `auth.experimental.jwt_bearer_client`.
- Update tests, docs (`server_options.rst`), and the release notes.
Related
- PR #4227 — introduced the boolean flag this issue replaces.
- PRD #4078 — overall RFC 7523 jwt-bearer client work.
- 主要语言
- Go
- 星标
- 29
- 派生
- 24
- 平均合并
- 2 天 18 小时
- 30 天内合并 PR
- 45
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
nuts-foundation/nuts-node 的其他 Issue
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
nuts-foundation/nuts-node#4450 ·
维护者通常 1 天内回复
-
bug discuss
难度 1/5 1 小时以内 新手友好度 88/100
nuts-foundation/nuts-node#4436 ·
维护者通常 1 天内回复
-
auth bug
难度 2/5 1-3 小时 新手友好度 82/100
nuts-foundation/nuts-node#4435 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
nuts-foundation/nuts-node#4321 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 88/100
nuts-foundation/nuts-node#4230 ·
维护者通常 1 天内回复
查看 nuts-foundation/nuts-node 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
github/github-mcp-server#3581 ·
维护者通常 2 天内回复
-
agent-review-finding chore
难度 1/5 1 小时以内 新手友好度 85/100
jordansmall/spindrift#6033 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 75/100
hyperledger/fabric-x-common#230 ·
维护者通常 1 天内回复
-
bug
难度 2/5 半天 新手友好度 65/100
open-wanderer/wanderer#1443 · 3 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复