search

TheThingsNetwork / lorawan-stack

The Things Stack, an Open Source LoRaWAN Network Server
https://www.thethingsindustries.com/stack/
Apache License 2.0
932 stars 301 forks source link

Allow use of unauthorized OAuth clients by collaborators #49

Open johanstokking opened 5 years ago

johanstokking commented 5 years ago

Summary:

We should allow collaborators of OAuth clients to use those clients before they are approved.

Why do we need this?

Would be very helpful for development.

What is already there? What do you see now?

Regular OAuth flow that rejects requests for "REQUESTED" clients.

What is missing? What do you want to see?

Before rejecting the request based on REQUESTED state, check if the current user collaborates on the OAuth client and then still allow the authorization.

How do you propose to implement this?

As described above, altough we should probably discuss the consequences first. Especially considering that you could add anyone as collaborator on the Client without them having to approve their membership.

Original issue: https://github.com/TheThingsIndustries/lorawan-stack/issues/1414 by @htdvisser

htdvisser commented 1 year ago

With #5414 landing in The Things Stack we can expect an increase in requests for OAuth client approvals. Since many of those clients will initially only be used for development (and not for use by the larger community) I think we should re-prioritize this issue so that we can make it easier for users to get started with developing OAuth clients without having to wait for admin approval.

cc: @NicolasMrad