+13

modules/zitadel/default.nix

View file Reviewed

··· 23 23 apps = lib.mapAttrs (_: app: { 24 24 inherit (app) redirectUris envFile; 25 25 authMethodType = "OIDC_AUTH_METHOD_TYPE_${lib.toUpper app.authMethod}"; 26 26 + grantTypes = [ 27 27 + "OIDC_GRANT_TYPE_AUTHORIZATION_CODE" 28 28 + ] 29 29 + ++ lib.optional app.refreshTokens "OIDC_GRANT_TYPE_REFRESH_TOKEN"; 26 30 }) project.apps; 27 31 }) cfg.projects; 28 32 } ··· 182 186 ]; 183 187 default = "basic"; 184 188 description = "How the app sends its client secret to the token endpoint."; 189 189 + }; 190 190 + refreshTokens = lib.mkOption { 191 191 + type = lib.types.bool; 192 192 + default = false; 193 193 + description = '' 194 194 + Allow the refresh_token grant. Zitadel hands out 195 195 + refresh tokens only when the app requests the 196 196 + offline_access scope. 197 197 + ''; 185 198 }; 186 199 envFile = { 187 200 path = lib.mkOption {

+1 -1

modules/zitadel/reconcile.py

View file Reviewed

··· 221 221 oidc_config = { 222 222 "redirectUris": app["redirectUris"], 223 223 "responseTypes": ["OIDC_RESPONSE_TYPE_CODE"], 224 224 - "grantTypes": ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE"], 224 224 + "grantTypes": app["grantTypes"], 225 225 "appType": "OIDC_APP_TYPE_WEB", 226 226 "authMethodType": app["authMethodType"], 227 227 }