mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
Bobby Ho
b9e3de8403
Fix OAuth2 callback edits retaining stale redirect URIs - Make `redirect_uris` the sole source of truth, with the first entry as primary and `callback_url` retained as a synchronized, deprecated copy. - Backfill existing apps and unify all writers. Callback-only admin updates now replace the previous primary while preserving alternate URIs. - Share redirect URI validation, reject fragments, and add limits of 32 URIs and 2048 bytes per URI. - Add regression coverage for migration, callback edits, validation, and rejection of removed URIs during authorization and token exchange. One data migration; no schema or request/response shape changes. Admin API and UI list editing follow separately. Rollout: Drain old replicas before upgrading; callback edits handled by old code are not reflected on new replicas. Refs PLAT-619.