fix(oidc): read a missing sessionExchangeEnabled as off

.changeset/application-response-older-api.md

@@ -0,0 +1,5 @@
+---
+'@seamless-auth/types': patch
+---
+
+`OidcApplicationSchema` reads a missing `sessionExchangeEnabled` as `false`. 0.36.0 made the field required, so a client on 0.36.0 refused the application list from any API older than v0.23, which does not send it.

src/schemas/oidcApplication/schema.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest';
 import {
   OidcApplicationCreateRequestSchema,
+  OidcApplicationSchema,
   OidcApplicationKeysRequestSchema,
   OidcApplicationResourcesRequestSchema,
   OidcApplicationUpdateRequestSchema,
@@ -358,6 +359,12 @@ describe('HostedUiSchema', () => {
 });
 
 describe('sessionExchangeEnabled', () => {
+  it('reads as off from an API older than the session exchange', () => {
+    const field = OidcApplicationSchema.shape.sessionExchangeEnabled;
+    expect(field.parse(undefined)).toBe(false);
+    expect(field.parse(true)).toBe(true);
+  });
+
   const nativeClient = {
     name: 'CLI',
     clientType: 'public',

src/schemas/oidcApplication/schema.ts

@@ -347,7 +347,8 @@ export const OidcApplicationSchema = z.object({
   grantTypes: z.array(OidcApplicationGrantTypeSchema),
   deviceFlowEnabled: z.boolean(),
   noticesEnabled: z.boolean(),
-  sessionExchangeEnabled: z.boolean(),
+  /** Absent from an API older than v0.23, which has no session exchange. */
+  sessionExchangeEnabled: z.boolean().default(false),
   pkceRequired: z.boolean(),
   nonceRequired: z.boolean(),
   jwks: OidcApplicationJwksSchema.nullable(),