From ad3322183ade3c0d0046494bb2feb8e9d7a4ec0b Mon Sep 17 00:00:00 2001 From: John Coffey Date: Fri, 18 Sep 2026 12:40:33 -0700 Subject: [PATCH] Contract: record the OAuth registration fix applied on production --- docs/spec/contract.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/spec/contract.md b/docs/spec/contract.md index bb926cd..6d59b33 100644 --- a/docs/spec/contract.md +++ b/docs/spec/contract.md @@ -237,6 +237,20 @@ C-18 (no admin scope for anything but `inbuxa-admin`). own web interface (`/admin`, `/account`), which signs in as the unregistered client `stalwart-webui`. +**Fixed on production, 2026-09-18,** in the order that keeps the web +interface working throughout: + +1. Registered `stalwart-webui` as an `x:OAuthClient` with exactly two redirect + URIs, the `/admin` and `/account` OAuth callbacks. +2. Turned `anonymousClientRegistration` off and `requireClientRegistration` on, + then reloaded settings. + +Verified over the API with a test account: `stalwart-webui` signs in to both +callbacks and exchanges its code for a token; the same client with a foreign +redirect URI, an unregistered `client_id`, and anonymous dynamic registration +are all refused (401). To roll back, set the two settings back, destroy the +client and reload settings. This is the state C-5 and C-6 make the default. + ## Acceptance tests 1. The session shows `urn:inbuxa:jmap` with `version`, `base`, `contract: 1`