feat(site): add OAuth2 dynamic client registration toggle to deployment settings#27480
Draft
BobbyHo wants to merge 1 commit into
Draft
feat(site): add OAuth2 dynamic client registration toggle to deployment settings#27480BobbyHo wants to merge 1 commit into
BobbyHo wants to merge 1 commit into
Conversation
…nt settings Surfaces the admin-controlled DCR setting from GET/PUT /api/v2/oauth2-provider/settings (added in #27316) on the OAuth2 Applications deployment settings page. Enabling the switch requires confirming a warning dialog, since it lets any client self-register against the deployment per RFC 7591; disabling is immediate.
Contributor
Author
Backend verificationManually verified against the local dev deployment (embedded Postgres + Default state (disabled)Postgres: API: After enabling via the UI (clicked the switch, confirmed the warning dialog)Audit log ( {
"id": "330e1fc8-046b-43de-b658-6b293a7a6c54",
"time": "2026-07-23T16:58:06.761606-05:00",
"resource_type": "oauth2_provider_settings",
"action": "write",
"diff": {
"dynamic_client_registration_enabled": {
"old": false,
"new": true,
"secret": false
}
},
"status_code": 200,
"description": "{user} updated oauth2 provider settings {target}",
"user": {
"username": "admin",
"roles": [{ "name": "owner", "display_name": "Owner" }]
}
}Postgres: API: After disabling via the UI (no confirmation dialog, disable is immediate)Audit log: {
"id": "1f702c97-a2e7-4f4e-afaf-f99cd4ced4b8",
"time": "2026-07-23T16:58:19.810326-05:00",
"resource_type": "oauth2_provider_settings",
"action": "write",
"diff": {
"dynamic_client_registration_enabled": {
"old": true,
"new": false,
"secret": false
}
},
"status_code": 200,
"description": "{user} updated oauth2 provider settings {target}",
"user": {
"username": "admin",
"roles": [{ "name": "owner", "display_name": "Owner" }]
}
}Postgres: API: The enable ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
Do not merge before #27316. This branch is stacked on
coder-eng-3056-dcr-flag(the head branch of #27316), so this PR'sbase is set to that branch instead of
main, keeping the diff hereto only the UI changes. Once #27316 merges, retarget this PR's base
to
main(or rebase) before merging.Adds the admin-controlled OAuth2 Dynamic Client Registration setting
from #27316 (
GET/PUT /api/v2/oauth2-provider/settings) to theOAuth2 Applications deployment settings page, since it was previously
only reachable via the API or
coder oauth2-provider dcr enable|disable.Enabling the toggle requires confirming a warning dialog, since it lets
any OAuth2 client self-register against the deployment without prior
admin approval (RFC 7591). Disabling is immediate, no confirmation.
Visibility and editability are gated on the same
ResourceDeploymentConfigRBAC checks the endpoint itself enforces (
viewDeploymentConfig/editDeploymentConfig), not a separate hardcoded check.Closes #27432
Screenshots
Default (disabled):
Enabling (confirmation dialog):
Enabled: