docs(docs/admin/integrations): note the OAuth2 registered scope enforcement for upgrades - #29144
Conversation
Docs previewCheck off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here. |
|
Could we include deployments that previously enabled DCR and have since turned it off? Turning it off only blocks new registrations; an existing client registered with |
…s turned off The upgrade note said registered scope enforcement only affects deployments with Dynamic Client Registration turned on. The setting gates registration only. The stored scope of an existing application is checked on every authorization regardless, so a client registered while DCR was on remains affected after it is turned off. Refs PLAT-482
nickvigilante
left a comment
There was a problem hiding this comment.
The content and accuracy hold up here: the fix endpoint, the "who's affected" logic, and the previously raised DCR-toggle case all check out. The one thing working against the note is readability. It's a single dense paragraph carrying about six ideas at once, and the opening sentence is ambiguous about who registers the application (the client self-registers; no admin sets the scope).
The inline suggestion keeps every fact but restructures it, following the docs style guide: one sentence per source line, "refer to" instead of "see," a short list for the failure modes, and an explicit actor so "registered" can't be misread as an admin action. It also links the existing Common Issues entries so the error detail isn't restated in two places. Non-blocking, take or leave any of it.
Posted by Coder Agents on behalf of @nickvigilante.
nickvigilante
left a comment
There was a problem hiding this comment.
Hope you don't mind I came in and reviewed this, but it overall LGTM with some rearranging and breaking up of the giant paragraph. Thanks for writing this up!
Co-authored-by: Nick Vigilante <[email protected]>
Thank you @nickvigilante for reviewing this PR and sharing your suggestion — really appreciate it! |
TL;DR
scopeoutsidescopes_supportednow fail instead of receiving full access.Contract change
What it says
oauth2experiment and Dynamic Client Registration enabled are affected. DCR is disabled by default.invalid_scope. If nothing registered is supported, every authorization fails. Pre-upgrade codes fail withinvalid_grant.Docs
docs/admin/integrations/oauth2-provider.md, Limitations section, after the existing refresh scope compatibility paragraph.release/breakingso the generated release notes list it too.Closes the release note item in PLAT-482.
🤖 Generated with Claude Code