From 6e65c56235d53e1bed92d7ed2da1e777550ff2ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Fri, 29 May 2026 12:23:58 +0200
Subject: [PATCH] Auto-register public-client OAuth connectors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Public-client (CIMD) providers need no operator credentials: derive
their client_id from the deployment base URL and their state-signing key
from the active OAuth2 server signing key, registering them at startup
unless the operator configured them explicitly.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/probod/probod.go | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go
index 78f23fdf5..ad90f24a4 100644
--- a/pkg/probod/probod.go
+++ b/pkg/probod/probod.go
@@ -365,8 +365,9 @@ func (impl *Implm) Run(
 	}
 
 	var (
-		oauth2SigningKeys oauth2server.SigningKeys
-		hasActive         bool
+		oauth2SigningKeys   oauth2server.SigningKeys
+		hasActive           bool
+		activeSigningKeyPEM string
 	)
 
 	for _, keyCfg := range impl.cfg.Auth.OAuth2Server.SigningKeys {
@@ -387,6 +388,7 @@ func (impl *Implm) Run(
 
 		if keyCfg.Active {
 			hasActive = true
+			activeSigningKeyPEM = keyCfg.PrivateKey
 		}
 
 		oauth2SigningKeys = append(
@@ -403,6 +405,34 @@ func (impl *Implm) Run(
 		return fmt.Errorf("cannot configure OAuth2 server: at least one signing key must be active")
 	}
 
+	// Auto-register public-client (CIMD) connectors, which need no operator
+	// credentials: the client_id is this deployment's hosted CIMD metadata
+	// URL and the OAuth2 state token is signed with a key derived from the
+	// active OAuth2 server signing key. Providers an operator configured
+	// explicitly (already registered from impl.cfg.Connectors above) are
+	// left untouched.
+	connectorStateKey := connector.DeriveConnectorStateKey(activeSigningKeyPEM)
+	cimdClientID := baseURL.WithPath(connector.CIMDMetadataPath).MustString()
+
+	for _, reg := range providerRegistry.PublicClients() {
+		if _, err := defaultConnectorRegistry.Get(string(reg.Provider)); err == nil {
+			continue
+		}
+
+		oauth2c := &connector.OAuth2Connector{
+			ClientID:        cimdClientID,
+			StateSigningKey: connectorStateKey,
+		}
+
+		if err := providerRegistry.ApplyOAuth2Defaults(string(reg.Provider), redirectURI, oauth2c); err != nil {
+			return fmt.Errorf("cannot apply oauth2 defaults for public client %q: %w", reg.Provider, err)
+		}
+
+		if err := defaultConnectorRegistry.Register(string(reg.Provider), oauth2c); err != nil {
+			return fmt.Errorf("cannot register public client connector %q: %w", reg.Provider, err)
+		}
+	}
+
 	if err := emails.UploadStaticAssets(
 		ctx,
 		s3Client,