[request] OAuth 2.0 Consumer Redirect URL should be optional

[matthewgo]

Not all grant types are using the redirect URL, shouldn't it be set as an optional field only?

[subnetmarco]

@givmefive5 this is correct. The reason why I kept asking for the redirect_uri even for those flows that don't require it was because new flows can be enabled/disabled at will, and for example enabling the three-legged Authorization Code Flow later on would suddenly break the plugin because it requires that field.

This can be fixed by checking if the redirect_uri is there for every application after enabling a previously disabled Authorization Code Flow.

As a quick fix you can just set a fake URL for now (pointing to your application's URL would be better).

[matthewgo]

Yeah, I thought that is the reason why you made it required. Thanks @thefosk !

[subnetmarco]

I will keep this issue open, so we don't forget to fix in the future. But I believe it's minor given our other priorities. But PR are welcome.

Basically every time the Authorization Code Flow is being enabled, we need to check that all the applications have a redirect_uri (basically some sort of SELECT COUNT (*) FROM oauth2_credentials WHERE redirect_uri IS NULL). If that's not the case, we need to return an error like:

Before enabling the authorization code flow make sure that every application has a redirect_uri set. There currently are N applications that need to be updated.