@idp.global/catalog 3.6.0 → 4.0.0

package/ts_web/elements/idp-admin-shell.ts

@@ -130,7 +130,7 @@ export interface IIdpAdminGaAppConfigureEventDetail {
   redirectUris: string[];
   postLogoutRedirectUris: string[];
   allowedScopes: string[];
-  grantTypes: Array<'authorization_code' | 'client_credentials' | 'refresh_token'>;
+  grantTypes: Array<'authorization_code' | 'refresh_token'>;
   oidcSettings: {
     accessTokenLifetime: number;
     idTokenLifetime: number;
@@ -1734,10 +1734,10 @@ export class IdpAdminShell extends DeesElement {
     const postLogoutRedirectUris = this.parseLines(this.dialogPostLogoutRedirectUris);
     const allowedScopes = this.parseCsv(this.dialogAllowedScopes);
     const configuredGrantTypes = this.parseCsv(this.dialogGrantTypes);
-    const supportedGrantTypes = ['authorization_code', 'client_credentials', 'refresh_token'];
+    const supportedGrantTypes = ['authorization_code', 'refresh_token'];
     const invalidGrantTypes = configuredGrantTypes.filter((grantArg) => !supportedGrantTypes.includes(grantArg));
     const grantTypes = configuredGrantTypes
-      .filter((grantArg): grantArg is 'authorization_code' | 'client_credentials' | 'refresh_token' => supportedGrantTypes.includes(grantArg));
+      .filter((grantArg): grantArg is 'authorization_code' | 'refresh_token' => supportedGrantTypes.includes(grantArg));
     const invalidUris = [...redirectUris, ...postLogoutRedirectUris].filter((uriArg) => !this.isValidExactUri(uriArg));
     const lifetimesAreValid = [this.dialogAccessTokenLifetime, this.dialogIdTokenLifetime]
       .every((lifetimeArg) => Number.isInteger(lifetimeArg) && lifetimeArg >= 300 && lifetimeArg <= 86400)
@@ -1764,10 +1764,6 @@ export class IdpAdminShell extends DeesElement {
       this.dialogError = 'The refresh_token grant requires the authorization_code grant.';
       return;
     }
-    if (this.dialogClientType === 'public' && grantTypes.includes('client_credentials')) {
-      this.dialogError = 'Public clients cannot use the client_credentials grant.';
-      return;
-    }
     if (!lifetimesAreValid) {
       this.dialogError = 'Access and ID token lifetimes must be 300 to 86400 seconds; refresh family lifetime must be 3600 to 7776000 seconds.';
       return;
@@ -2034,7 +2030,7 @@ export class IdpAdminShell extends DeesElement {
           ${this.renderFormRow('Callback URIs', 'One exact absolute URI per line; required for authorization_code.', html`<textarea class="textarea" .value=${this.dialogRedirectUris} @input=${(eventArg: Event) => { this.dialogRedirectUris = (eventArg.target as HTMLTextAreaElement).value; }}></textarea>`)}
           ${this.renderFormRow('Post-logout URIs', 'One exact RP-Initiated Logout destination per line.', html`<textarea class="textarea" .value=${this.dialogPostLogoutRedirectUris} @input=${(eventArg: Event) => { this.dialogPostLogoutRedirectUris = (eventArg.target as HTMLTextAreaElement).value; }}></textarea>`)}
           ${this.renderFormRow('Allowed scopes', 'Comma-separated scopes; authorization_code requires openid.', html`<input class="input" .value=${this.dialogAllowedScopes} @input=${(eventArg: Event) => { this.dialogAllowedScopes = (eventArg.target as HTMLInputElement).value; }} />`, true)}
-          ${this.renderFormRow('Grant types', 'authorization_code, client_credentials, and refresh_token are supported.', html`<input class="input" .value=${this.dialogGrantTypes} @input=${(eventArg: Event) => { this.dialogGrantTypes = (eventArg.target as HTMLInputElement).value; }} />`, true)}
+          ${this.renderFormRow('Grant types', 'authorization_code and refresh_token are supported.', html`<input class="input" .value=${this.dialogGrantTypes} @input=${(eventArg: Event) => { this.dialogGrantTypes = (eventArg.target as HTMLInputElement).value; }} />`, true)}
           <div class="mapping-row">
             <div>${this.renderFormRow('Access token seconds', '300 to 86400.', html`<input class="input" type="number" .value=${String(this.dialogAccessTokenLifetime)} @input=${(eventArg: Event) => this.setDialogNumber('access', eventArg)} />`, true)}</div>
             <div>${this.renderFormRow('ID token seconds', '300 to 86400.', html`<input class="input" type="number" .value=${String(this.dialogIdTokenLifetime)} @input=${(eventArg: Event) => this.setDialogNumber('id', eventArg)} />`, true)}</div>
@@ -2250,10 +2246,10 @@ export class IdpAdminShell extends DeesElement {
               ${this.deleteAccountOpen
                 ? html`
                     ${this.renderFormRow('Confirm your email', 'Type your account email to confirm', html`<input class="input" .value=${this.deleteAccountConfirmEmail} ?disabled=${this.accountDeleting} @input=${(eventArg: Event) => { this.deleteAccountConfirmEmail = (eventArg.target as HTMLInputElement).value; }} />`, true)}
-                    ${this.renderFormRow('Password', 'Required when your account has one', html`<input class="input" type="password" autocomplete="current-password" .value=${this.deleteAccountPassword} ?disabled=${this.accountDeleting} @input=${(eventArg: Event) => { this.deleteAccountPassword = (eventArg.target as HTMLInputElement).value; }} />`)}
+                    ${this.renderFormRow('Password', 'Required. Passwordless account deletion needs a future fresh-auth step-up.', html`<input class="input" type="password" autocomplete="current-password" .value=${this.deleteAccountPassword} ?disabled=${this.accountDeleting} @input=${(eventArg: Event) => { this.deleteAccountPassword = (eventArg.target as HTMLInputElement).value; }} />`)}
                     <div class="split-row" style="justify-content:flex-end;gap:10px;margin-top:14px">
                       <idp-button variant="outline" shape="rect" ?disabled=${this.accountDeleting} @click=${() => { this.deleteAccountOpen = false; this.deleteAccountPassword = ''; this.deleteAccountConfirmEmail = ''; }}>Cancel</idp-button>
-                      <idp-button variant="accent" shape="rect" ?loading=${this.accountDeleting} ?disabled=${this.deleteAccountConfirmEmail.trim().toLowerCase() !== (this.user?.email || '').trim().toLowerCase()} @click=${() => this.dispatchShellEvent<IIdpAdminAccountDeleteEventDetail>('idp-admin-account-delete', { password: this.deleteAccountPassword, confirmEmail: this.deleteAccountConfirmEmail.trim() })}>Delete my account</idp-button>
+                      <idp-button variant="accent" shape="rect" ?loading=${this.accountDeleting} ?disabled=${!this.deleteAccountPassword || this.deleteAccountConfirmEmail.trim().toLowerCase() !== (this.user?.email || '').trim().toLowerCase()} @click=${() => this.dispatchShellEvent<IIdpAdminAccountDeleteEventDetail>('idp-admin-account-delete', { password: this.deleteAccountPassword, confirmEmail: this.deleteAccountConfirmEmail.trim() })}>Delete my account</idp-button>
                     </div>
                   `
                 : html`<div class="split-row"><div><div class="section-title">Delete this account</div><div class="muted">Organisations you own must be transferred or deleted first.</div></div><idp-button variant="outline" shape="rect" @click=${() => { this.deleteAccountOpen = true; }}>Delete account…</idp-button></div>`}