OAuth/OIDC integration and current source profile
Discovery and trust
Section titled “Discovery and trust”curl --fail --silent --show-error https://id.zorin.cloud/.well-known/openid-configurationRead endpoints/JWKS from discovery and compare the issuer to your configured expected issuer. Never accept an arbitrary issuer from an unverified token. Authorization Code, refresh, restricted client credentials and Device Authorization depend on client type and server policy.
Endpoints and schemas
Section titled “Endpoints and schemas”The reference includes discovery, JWKS, authorize, PAR, token, userinfo, revoke, introspect, logout and device authorization, with nested request/response fields and grant alternatives. OpenAPI describes the current source profile, not complete OAuth/OIDC conformance or authenticated E2E verification.
Client and grant restrictions
Section titled “Client and grant restrictions”- THIRD_PARTY client_credentials is disabled; SECOND_PARTY is limited to allowed ingress scopes.
- Device Authorization is currently FIRST_PARTY + MIX Account, pending external device consent support.
- Introspection/revocation require a confidential client. Confidential authentication uses Basic or client_secret_post; PAR also permits PUBLIC clients in this source profile.
- Native FIRST_PARTY Account/Console cookie/CSRF routes are not this public contract. events.ingress and machine grants are not available to every external app.
Errors and current deviations
Section titled “Errors and current deviations”Treat consent denial, invalid/expired code or state, wrong client and redirect mismatch as failed login. Do not retry one-time code exchange indefinitely or log code/access/refresh/ID tokens. Use bounded network/5xx retries only when the operation is safe; reusing a rotated refresh token may revoke its family.
Current OAuth POST handlers do not set an explicit Nest HttpCode and therefore use 201. Errors use Nest BadRequestException/UnauthorizedException rather than a dedicated OAuth error serializer; device polling errors may appear as message rather than error. These are implementation gaps before generic-client interoperability, not a target standards contract. Nest status-code behavior.
Only read-only discovery/public availability has been checked live. Successful token issuance/refresh and real external client registration were not exercised here; no real credentials are embedded in examples.