Skip to content

ENG-31: Solid-OIDC Client Id Document support - #17

Open
langsamu wants to merge 4 commits into
mainfrom
client-improvements
Open

ENG-31: Solid-OIDC Client Id Document support#17
langsamu wants to merge 4 commits into
mainfrom
client-improvements

Conversation

@langsamu

@langsamu langsamu commented Jun 14, 2026

Copy link
Copy Markdown
Collaborator

Implements the titular feature.

To run in demo mode, requires

  • uncommenting some lines in index.html,
  • enabling insecure requests in some places in the DPoP provider and AS provider
  • as well as a Solid server running on localhost (e.g.
npx @solid/community-server

so it can reference a client Id doc on localhost.

langsamu added 3 commits June 14, 2026 20:59
# Conflicts:
#	index.html
#	src/DPoPTokenProvider.ts
#	src/mod.ts
#	src/reactive-fetch-worker.ts
@langsamu
langsamu force-pushed the client-improvements branch 2 times, most recently from ea1bcdf to bc18ae9 Compare September 2, 2026 17:16
@langsamu
langsamu force-pushed the client-improvements branch from bc18ae9 to 9f1e4a3 Compare September 2, 2026 17:16
@langsamu langsamu changed the title Solid-OIDC Client Id Document support ENG-31: Solid-OIDC Client Id Document support Sep 2, 2026
@langsamu
langsamu marked this pull request as ready for review September 2, 2026 17:22
Comment thread index.html
const cachingASProvider = new CachingAuthorizationServerProvider(asProvider)
const callbackUri = new URL("/callback.html", location.href).toString()
const clientProvider = new DynamicRegistrationClientProvider
// const clientProvider = new ClientIdClientProvider(new URL("./id.jsonld", location.href))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we have things commented out in a PR?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This index.html file is what currently goes for test/demo harness.
These commented lines facilitate experimentation with the new feature.

This is far from done, to be replaced down the line with unit tests, documentation comments and example code.

Would you like me to remove here or are you OK for this to evolve slowly?

}

async getClient(_: oauth.AuthorizationServer, __: string, signal: AbortSignal): Promise<oauth.Client> {
const response = await fetch(this.clientIdDocUri, {signal})

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like it will get overriden when we are monkey patching and so suffer from the issues that #21 tries to fix.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, relying on the global fetch makes this prone to the same problem.
I'd rather not mitigate that here but treat it holistically across the codebase.
Especially considering #19 and the potential to eliminate monkey patching altogether.

I imagine the best approach would be (as hinted in #21) would be for our API to take a fetch and perhaps for the manager to pass its original fetch to these methods. Even regardless of not monkey patching.

@langsamu
langsamu requested a review from jeswr September 3, 2026 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants