Public-client config: optional clientSecretRef (CRD + registry) #32

New issue

Closed

opened 2026-09-15 23:26:58 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-15 23:26:58 +00:00

Owner

Parent

#31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio

What to build

An OauthClient can be declared without a clientSecretRef, declaring a Public client. The Registry builds such an App as Available with SecretReady trivially true (there is no secret to watch), and the structural gate relaxes so a client is valid with or without a well-formed secret ref. A Confidential client (secret present) is unchanged. An exchange-only App can now omit the secret it never uses.

Acceptance criteria

OauthClient.clientSecretRef is optional in the CRD (a public client omits it).
A public-client OauthClient builds an Available Registry entry with SecretReady true and no referenced Secret.
A present-but-malformed clientSecretRef still degrades (InvalidSecretRef).
A Confidential client still watches its secret and degrades to SecretNotReady when the Secret is missing.
make manifests generate, make lint, and make test pass.

Blocked by

None — can start immediately.

## Parent #31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio ## What to build An `OauthClient` can be declared **without** a `clientSecretRef`, declaring a **Public client**. The Registry builds such an App as **Available** with `SecretReady` trivially true (there is no secret to watch), and the structural gate relaxes so a client is valid with or without a well-formed secret ref. A Confidential client (secret present) is unchanged. An exchange-only App can now omit the secret it never uses. ## Acceptance criteria - [ ] `OauthClient.clientSecretRef` is optional in the CRD (a public client omits it). - [ ] A public-client `OauthClient` builds an Available Registry entry with `SecretReady` true and no referenced Secret. - [ ] A present-but-malformed `clientSecretRef` still degrades (`InvalidSecretRef`). - [ ] A Confidential client still watches its secret and degrades to `SecretNotReady` when the Secret is missing. - [ ] `make manifests generate`, `make lint`, and `make test` pass. ## Blocked by - None — can start immediately.

ginjiruu referenced this issue

2026-09-15 23:27:18 +00:00

PKCE (always) + id_token nonce + public-client no-secret #36

ginjiruu referenced this issue

2026-09-15 23:27:28 +00:00

E2E: portable-cluster rip-and-replace re-run (OIDC + Exchange; #30 gateway gate) #37

ginjiruu added the

ready-for-agent

label

2026-09-15 23:27:33 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-09-16 00:38:14 +00:00