Description
Add support for public/native OAuth2 clients that do not use a client secret.
The OAuth setup should allow selecting either:
- Confidential client: uses an encrypted client secret.
- Public/native client: uses PKCE and omits the client secret.
Purpose / Use Case
Desktop and native applications cannot safely keep a client secret. Providers such as Microsoft Entra support public clients with PKCE, but Bichon currently assumes that every OAuth client has a secret.
This would allow Bichon to archive accounts using public OAuth clients while preserving the existing confidential-client flow.
Additional Information (optional)
Existing OAuth records should remain confidential by default. Public clients must never store or send a client secret. The existing callback, state validation, token encryption, and refresh flow can remain unchanged.
I have a working implementation on my fork and would be happy to adapt it and provide a pull request if this approach is acceptable.
Description
Add support for public/native OAuth2 clients that do not use a client secret.
The OAuth setup should allow selecting either:
Purpose / Use Case
Desktop and native applications cannot safely keep a client secret. Providers such as Microsoft Entra support public clients with PKCE, but Bichon currently assumes that every OAuth client has a secret.
This would allow Bichon to archive accounts using public OAuth clients while preserving the existing confidential-client flow.
Additional Information (optional)
Existing OAuth records should remain confidential by default. Public clients must never store or send a client secret. The existing callback, state validation, token encryption, and refresh flow can remain unchanged.
I have a working implementation on my fork and would be happy to adapt it and provide a pull request if this approach is acceptable.