feat: request spec-aligned scopes, retry without resource indicators, and validate iss on remote login

[daviddanialy]

AIM-202. Stacked on #6107.

Summary

Makes the upstream OAuth request adapt to each issuer.

• Scopes. Client.RequestedScopes: scope_override verbatim if set; else the client's stored scope, falling back to the issuer's scopes_supported; then openid, email, profile, offline_access appended when the issuer advertises them. Widening logs at debug; an empty override means none. The requested set is recorded on the session when the token response omits scope (RFC 6749 §5.1).
• RFC 8707. resource is sent on authorize, exchange, and refresh unless resource_indicator_supported is false. resource_indicator_supported is purely an operator override; Gram never writes it from a login. On invalid_target the callback retries that login once without resource, and the refresh grant gets the same one-shot retry inside its single-flight lease; any other error is final and nothing is generalised to the issuer or to other grants, since a rejection can be about one resource rather than RFC 8707 support. The resource stays on the session for routing.
• RFC 9207. When the issuer advertises authorization_response_iss_parameter_supported, the callback rejects a response whose iss is missing or different, before the denial branch and the exchange. Compared to the discovery document's issuer, or the stored URL without its trailing slash when no document exists.
• Callback hygiene. A callback with neither code nor error leaves the login state alone. Denials echo only IETF-registered error codes. Upstream and browser text is capped before logging. Token-endpoint error bodies are parsed with oautherr.ParseTokenError.
• Consent card. "Reconnect to enable identity" on a connected grant that lacks openid while a reconnect would request it; the first-party page no longer auto-closes over such a card.
• Unchanged-behaviour suite. challenge_unchanged_regression_test.go and its mcp sibling pin the exact authorize URL, exchange and refresh bodies, callback handling without the iss capability, verbatim response-scope storage, pre-PR login states, and first-party auto-close for issuers the new rules do not touch. Two changes apply to every issuer and are pinned as such: a denial consumes the login state, and a token response without scope records the requested set.
• API. Both columns on the issuer type, draft, and create/update forms at all tiers; update keeps scope_override when omitted or null and clears it on []; the form field serializes without omitempty at every tier so generated clients can send [], and the OpenAPI marks it nullable. SDK regenerated. Dashboard exposure deferred; an omitted field keeps the stored value, so dashboard saves cannot clobber them.

Motivation

Linear never returned an ID token because openid was never requested. Vercel sessions died after an hour because offline_access was never requested. WorkOS never connected because it rejects resource. The callback never checked iss. Scope and iss are per-issuer rules, so those knobs live on the issuer row. Resource-indicator support is learned per grant at runtime instead, with one retry so a misbehaving provider cannot loop a user.

🤖 Generated with Claude Code

[linear-code]

AIM-202

[changeset-bot]

🦋 Changeset detected

Latest commit: 9ee890f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
server	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — Running ultrareview automatically — This change rewrites core remote-login OAuth behavior (scope resolution, RFC 8707 resource handling with retry, RFC 9207 iss validation) across the callback and issuer API, so a subtle bug could break auth or route grants.. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 25m 14s

Review completed against the latest diff

Linked issue analysis

Linked issue: AIM-202: Spec-aligned per-issuer scope and resource-indicator strategy for upstream authorization

Status	Acceptance criteria	Notes
⚠️	Resolve upstream scopes from the configured override or client/issuer scope source, and append advertised openid, email, profile, and offline_access scopes.	The PR documents and tests the override/base precedence and advertised standard-scope appending, but the provided evidence does not clearly demonstrate the issue's required merge semantics between ClientScope and issuer scopes_supported.
✅	When an issuer rejects RFC 8707 resource with invalid_target, learn that capability, retry once without resource, and retain the resource on the resulting session.	The PR describes gating resource on both authorization and exchange, parsing invalid_target, persisting the issuer flag, retrying exactly once, and retaining the resource; an end-to-end test covers the strategy.
✅	Validate the RFC 9207 iss callback parameter when the issuer advertises authorization_response_iss_parameter_supported.	The callback compares the returned iss with the expected issuer and rejects missing or mismatched values; the strategy end-to-end test covers this behavior.
✅	Show a reconnect hint when a live grant lacks openid but reconnecting would request it.	Scopes are plumbed into session state and card rendering, the template adds the requested copy and reconnect action, and dedicated tests cover the behavior.
✅	Expose scope_override and resource_indicator_supported as issuer configuration across supported API forms and models.	The PR adds the fields to the issuer design, generated API schemas and models, create/update payloads, persistence, and view mapping.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[daviddanialy]

Testing summary:

Reviews. Three independent passes (security, behavioural correctness against AIM-202 and the RFCs, data and API surface). One blocker found and closed: the resource-indicator flag is now learned only from a token-endpoint invalid_target, never from the browser-forgeable redirect. All should-fixes applied.

Unit and end to end (remotesessions, mcp): scope precedence rows including NULL and empty scopes_supported and empty override; refresh grant with the flag NULL, true, and false; forged redirect invalid_target leaves the flag NULL; token-endpoint invalid_target learns false; retry leg refused on a second invalid_target and when no resource was recorded; response scope stored over the requested set; iss fallback with and without a trailing slash; consent hint with empty stored scopes; denial echoes only registered codes; bare ?state= does not consume a login; the flag write hits org rows and refuses global and foreign-org rows; scope_override create [] stores NULL, update [] clears, omitted keeps, at project and org tiers; first-party page stays open over a reconnectable card.

Unchanged-behaviour suite (24 cases): exact authorize URL key set and scope for issuers advertising nothing, exchange and refresh bodies, callbacks without the iss capability, verbatim response-scope storage, clients already carrying the standard scopes, pre-PR login states read from Redis, and first-party auto-close for grants that already have openid.

Browser, local stack with dev-idp as the upstream issuer: baseline connect widened email to email openid profile and stored it; reconnect hint shown, page did not auto-close, Reconnect cleared it; scope_override sent verbatim; auto-close still fires for a grant with openid. iss validation and invalid_target not exercisable against dev-idp (it advertises neither) and are covered by the Go tests above.

Suites. remotesessions and mcp: 1,430 tests. Full server suite: 15,455 (two contention flakes outside these packages, pass in isolation). Dashboard unit suite: 3,230. Server lint clean.

[danielkov]

Couple Astra findings. I didn't see anything else.