Add OAuth device code flow by ejsmith · Pull Request #2352 · exceptionless/Exceptionless · GitHub

Summary

Adds RFC 8628-style OAuth device authorization for remote and headless MCP/OAuth clients. Device clients can request a device/user code, users can approve access through the Svelte verification page, and token polling now returns the expected pending, slow_down, denied, expired, or token responses.

Changes

Added urn:ietf:params:oauth:grant-type:device_code support, authorization server metadata, device authorization, consent, approve, deny, and token exchange endpoints.
Stores pending device authorizations in cache with opaque device codes, normalized user-code lookup, expiration, polling interval enforcement, and one-time consumption.
Added persisted OAuth application grant_types across models, dynamic registration, repository mapping, admin API, and admin UI.
Added Svelte /next/oauth/device verification flow with manual code entry and verification_uri_complete support.
Updated OAuth HTTP samples, AI tools copy, controller tests, admin tests, and OpenAPI baseline.

Compatibility

Existing authorization-code clients continue to default to authorization_code refresh_token. Authorization-code clients still require redirect URIs; device-only clients may omit redirects.

Validation

dotnet test --project tests/Exceptionless.Tests/Exceptionless.Tests.csproj -- --filter-class Exceptionless.Tests.Controllers.OAuthControllerTests
dotnet test --project tests/Exceptionless.Tests/Exceptionless.Tests.csproj -- --filter-class Exceptionless.Tests.Controllers.OAuthApplicationControllerTests
dotnet build --no-restore -v:q
cd src/Exceptionless.Web/ClientApp; npm run build
OpenAPI baseline snapshot regenerated and verified
git diff --check

…feature/oauth-device-flow

…flow

/preview

Preview deployed

App: https://dev-app.exceptionless.io
Collector: https://dev-collector.exceptionless.io
Commit: 8780491417a0
Version: 8.8.1-preview.feature.oauth-device-flow.0.8
Workflow run: view logs

- Mark optional build dependencies as dev in `package-lock.json` - Remove obsolete libc qualifiers from lock entries

…flow # Conflicts: # src/Exceptionless.Web/ClientApp/package-lock.json

Follow-up feedback and thermo-nuclear audit complete.

Feedback classification

Submitted reviews, inline comments, and review threads: none. GitHub currently reports 0 submitted reviews, 0 inline comments, and 0 review threads, so there are no Codex, Copilot, or human review findings to accept, reject, reply to, or resolve.
/preview from ejsmith: old operational trigger, already fulfilled. The current preview is deployed from e880702ad49c.
Preview deployment bot comment: informational and current; no requested action.
Coverage bot comment: informational; current aggregate coverage is 77%, with no requested action or branch-specific regression finding.

Proven RCA and surgical fix

The full branch-vs-main audit found one real cache-ownership race. A stale user-code lookup read owner A, failed to find A's device authorization, and then unconditionally deleted the shared user-code key. If that key had been reassigned to owner B between the read and cleanup, A could delete B's valid mapping.

Commit e880702ad49c centralizes user-code cleanup behind compare-and-remove semantics and uses that invariant for creation rollback, authorization removal, and stale lookup cleanup. The focused regression proves that a stale owner cannot remove a reassigned mapping while the current owner still can.

Thermo-nuclear diff audit

Audited the complete effective diff against origin/main, including state transitions, authorization boundaries, serialization compatibility, generated API contracts, frontend consent behavior, helper duplication, branching, async orchestration, and file growth. No further actionable issue was proven. OAuthService remains at 998 lines and the dedicated OAuthDeviceService at 624 lines; the feature does not push a production file across 1,000 lines.

Verification

dotnet test --project tests/Exceptionless.Tests/Exceptionless.Tests.csproj --no-restore -- --filter-class Exceptionless.Tests.Services.OAuthDeviceServiceTests --parallel none --max-threads 1 — 1/1 passed.
dotnet build tests/Exceptionless.Tests/Exceptionless.Tests.csproj --no-restore --nologo --disable-build-servers -m:1 — passed with 0 warnings and 0 errors.
git diff --check — clean.
GitHub Actions run 30210204358 — API 8m18s, client 1m38s, E2E 4m51s, Docker build 4m07s, Docker publish 43s, deploy 52s, preview, version, and CLA all passed; website deploy skipped as expected.

A local integration-host attempt was blocked before the test body by unrelated shared Elasticsearch test-* alias/index conflicts from concurrent worktrees. The isolated unit regression passed, and the clean CI API suite provides the authoritative broader backend proof.

No external blocker remains. Draft/admin state was not changed.

overall looks good

# Conflicts: # src/Exceptionless.Core/Configuration/OAuthServerOptions.cs # src/Exceptionless.Core/Services/OAuthService.cs # tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs

…flow

# Conflicts: # src/Exceptionless.Core/Services/OAuthService.cs # src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte # tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs

Package	Line Rate	Branch Rate	Complexity	Health
Exceptionless.Insulation	37%	35%	286	❌
Exceptionless.Core	76%	67%	10388	✔
Exceptionless.Web	85%	69%	7950	✔
Exceptionless.AppHost	38%	41%	147	❌
Summary	78% (25558 / 32632)	67% (11964 / 17784)	18771	✔

ejsmith added 6 commits July 6, 2026 00:00

Add OAuth device code flow

8195217

Merge branch 'main' into feature/oauth-device-flow

43678d9

Address OAuth device flow review feedback

da097de

Merge remote-tracking branch 'origin/feature/oauth-device-flow' into …

c688daf

…feature/oauth-device-flow

Fix OAuth device flow CI checks

f76a696

Merge remote-tracking branch 'origin/main' into feature/oauth-device-…

de8f898

…flow

github-actions Bot added the dev-preview Deploy this pull request to the shared dev environment. label Jul 6, 2026

ejsmith and others added 7 commits July 8, 2026 10:46

Fix OAuth refresh token replay race

e14b150

Normalize client package-lock metadata

2bcc3aa

- Mark optional build dependencies as dev in `package-lock.json` - Remove obsolete libc qualifiers from lock entries

Merge remote-tracking branch 'origin/main' into feature/oauth-device-…

b40e106

…flow # Conflicts: # src/Exceptionless.Web/ClientApp/package-lock.json

Merge main and harden OAuth device flow

7224e29

Merge origin/main into feature/oauth-device-flow

85340d6

Harden OAuth device authorization flow

af8f6bc

Preserve OAuth device user-code ownership

e880702

niemyjski reviewed Aug 2, 2026

View reviewed changes

Comment thread src/Exceptionless.Core/Models/OAuthApplication.cs

niemyjski reviewed Aug 2, 2026

View reviewed changes

Comment thread src/Exceptionless.Core/Services/OAuthService.cs Outdated

niemyjski approved these changes Aug 2, 2026

View reviewed changes

niemyjski reviewed Aug 2, 2026

View reviewed changes

Comment thread tests/Exceptionless.Tests/Serializer/Models/OAuthApplicationSerializerTests.cs

niemyjski added 6 commits August 5, 2026 09:02

Merge remote-tracking branch 'origin/main' into HEAD

92a1d00

# Conflicts: # src/Exceptionless.Core/Configuration/OAuthServerOptions.cs # src/Exceptionless.Core/Services/OAuthService.cs # tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs

Fix OAuth device consent client import

d460445

Merge remote-tracking branch 'origin/main' into feature/oauth-device-…

fd3b4be

…flow

Address OAuth device flow review feedback

823bdca

Merge remote-tracking branch 'origin/main' into HEAD

ba84e1b

# Conflicts: # src/Exceptionless.Core/Services/OAuthService.cs # src/Exceptionless.Web/ClientApp/src/routes/(auth)/oauth/authorize/+page.svelte # tests/Exceptionless.Tests/Api/Endpoints/OAuthEndpointTests.cs

Fix OAuth client formatting after base merge

8780491

Add OAuth device code flow by ejsmith · Pull Request #2352 · exceptionless/Exceptionless · GitHub

Uh oh!

Uh oh!

Add OAuth device code flow - #2352

Add OAuth device code flow#2352
ejsmith wants to merge 19 commits into
mainfrom
feature/oauth-device-flow

ejsmith commented Jul 6, 2026

Uh oh!

ejsmith commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026 •
edited
Loading

Uh oh!

Uh oh!

niemyjski commented Jul 26, 2026

Uh oh!

Uh oh!

Uh oh!

niemyjski left a comment

Uh oh!

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Add OAuth device code flow by ejsmith · Pull Request #2352 · exceptionless/Exceptionless · GitHub

Uh oh!

Uh oh!

Add OAuth device code flow - #2352

Add OAuth device code flow#2352ejsmith wants to merge 19 commits intomainexceptionless/Exceptionless:mainfrom feature/oauth-device-flowexceptionless/Exceptionless:feature/oauth-device-flowCopy head branch name to clipboard

Conversation

ejsmith commented Jul 6, 2026

Summary

Changes

Compatibility

Validation

Uh oh!

ejsmith commented Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

niemyjski commented Jul 26, 2026

Feedback classification

Proven RCA and surgical fix

Thermo-nuclear diff audit

Verification

Uh oh!

Uh oh!

Uh oh!

niemyjski left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Add OAuth device code flow#2352
ejsmith wants to merge 19 commits into
mainfrom
feature/oauth-device-flow

github-actions Bot commented Jul 6, 2026 •
edited
Loading