Files
continuwuity/src
Michel-Marie MAUDET f0493a7ba8 fix(oauth): Use unauthorized_client for unregistered grant types
The token endpoint already refused grant types the client had not
registered, but reported it as `invalid_grant`. RFC 6749 section 5.2
reserves `invalid_grant` for an authorization grant which is "invalid,
expired, revoked, does not match the redirection URI used in the
authorization request, or was issued to another client", and defines
`unauthorized_client` for a client which "is not authorized to use this
authorization grant type".

Report the condition with the error code the specification assigns to it,
matching the device authorization endpoint.
2026-08-07 08:52:20 +00:00
..
2026-08-03 14:35:53 +00:00
2026-07-02 16:34:38 -04:00