frommeandClaude Opus 5
65c1a7bd12
The Teamer app imports travel and hotel master data nightly with no user
in the loop. AuthorizationCodeListener is bound to
AUTHORIZATION_REQUEST_RESOLVE, which only the auth code grant dispatches,
so a userless token never reaches the required_roles gate.
Drops the tagged grant service added in 79709e3a. That tag registered
client_credentials through the bundle's @deprecated grant configurator,
which runs regardless of enable_client_credentials_grant and re-enabled
the grant a second time with its own PT1H. Two enableGrantType() calls
for one grant left the lifetime decided by call order. M2M tokens now use
the shared access_token_ttl of PT10M.
Co-Authored-By: Claude Opus 5 <[email protected]>
30 lines
1.0 KiB
YAML
30 lines
1.0 KiB
YAML
league_oauth2_server:
|
|
authorization_server:
|
|
private_key: '%env(resolve:OAUTH_PRIVATE_KEY)%'
|
|
private_key_passphrase: null
|
|
encryption_key: '%env(resolve:OAUTH_ENCRYPTION_KEY)%'
|
|
require_code_challenge_for_public_clients: true
|
|
enable_client_credentials_grant: true
|
|
enable_auth_code_grant: true
|
|
enable_refresh_token_grant: true
|
|
enable_password_grant: false
|
|
enable_implicit_grant: false
|
|
access_token_ttl: PT10M
|
|
resource_server:
|
|
public_key: '%env(resolve:OAUTH_PUBLIC_KEY)%'
|
|
scopes:
|
|
available: ['email','id','profile','roles','api']
|
|
default: ['email']
|
|
persistence:
|
|
doctrine: null
|
|
client:
|
|
allow_plaintext_secrets: false
|
|
# App\Entity\OAuth2Client adds the required_roles column that
|
|
# App\EventListener\AuthorizationCodeListener gates authorization on.
|
|
classname: App\Entity\OAuth2Client
|
|
|
|
when@test:
|
|
league_oauth2_server:
|
|
persistence:
|
|
in_memory: null
|