From 02f7500bbadfb4ae14c18af731cb47138f389da4 Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Thu, 5 Nov 2026 08:05:41 -0500 Subject: [PATCH 1/2] test(oidc): read an application from an API older than the session exchange --- src/schemas/oidcApplication/schema.test.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/schemas/oidcApplication/schema.test.ts b/src/schemas/oidcApplication/schema.test.ts index 3532493..101671d 100644 --- a/src/schemas/oidcApplication/schema.test.ts +++ b/src/schemas/oidcApplication/schema.test.ts @@ -1,6 +1,7 @@ import { describe, it, expect } from 'vitest'; import { OidcApplicationCreateRequestSchema, + OidcApplicationSchema, OidcApplicationKeysRequestSchema, OidcApplicationResourcesRequestSchema, OidcApplicationUpdateRequestSchema, @@ -358,6 +359,12 @@ describe('HostedUiSchema', () => { }); describe('sessionExchangeEnabled', () => { + it('reads as off from an API older than the session exchange', () => { + const field = OidcApplicationSchema.shape.sessionExchangeEnabled; + expect(field.parse(undefined)).toBe(false); + expect(field.parse(true)).toBe(true); + }); + const nativeClient = { name: 'CLI', clientType: 'public', From 74aba8529285a5254a2a5c34cd6dfcb5d9e432ad Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Thu, 5 Nov 2026 08:05:43 -0500 Subject: [PATCH 2/2] fix(oidc): read a missing sessionExchangeEnabled as off --- .changeset/application-response-older-api.md | 5 +++++ src/schemas/oidcApplication/schema.ts | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 .changeset/application-response-older-api.md diff --git a/.changeset/application-response-older-api.md b/.changeset/application-response-older-api.md new file mode 100644 index 0000000..cbb9ce8 --- /dev/null +++ b/.changeset/application-response-older-api.md @@ -0,0 +1,5 @@ +--- +'@seamless-auth/types': patch +--- + +`OidcApplicationSchema` reads a missing `sessionExchangeEnabled` as `false`. 0.36.0 made the field required, so a client on 0.36.0 refused the application list from any API older than v0.23, which does not send it. diff --git a/src/schemas/oidcApplication/schema.ts b/src/schemas/oidcApplication/schema.ts index bef30b3..51fdecb 100644 --- a/src/schemas/oidcApplication/schema.ts +++ b/src/schemas/oidcApplication/schema.ts @@ -347,7 +347,8 @@ export const OidcApplicationSchema = z.object({ grantTypes: z.array(OidcApplicationGrantTypeSchema), deviceFlowEnabled: z.boolean(), noticesEnabled: z.boolean(), - sessionExchangeEnabled: z.boolean(), + /** Absent from an API older than v0.23, which has no session exchange. */ + sessionExchangeEnabled: z.boolean().default(false), pkceRequired: z.boolean(), nonceRequired: z.boolean(), jwks: OidcApplicationJwksSchema.nullable(),