yavsc/src/Yavsc.Org/Views/Client/Edit.cshtml

309 lines
14 KiB
Text
Raw Normal View History

2025-08-19 15:40:16 +01:00
@model Client
2026-07-04 20:03:56 +01:00
@{
ViewBag.Title = Localizer["Client"];
}
2025-08-19 15:40:16 +01:00
2026-02-22 23:39:56 +00:00
<h2>@Localizer["Edit"]</h2>
2025-08-19 15:40:16 +01:00
<form asp-action="Edit">
<div class="form-horizontal">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<h4>Client <code>@Model.ClientId</code></h4>
2025-08-19 15:40:16 +01:00
<hr />
<div asp-validation-summary="ModelOnly" class="text-danger"></div>
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<input type="hidden" asp-for="Id" />
2025-08-24 16:07:53 +01:00
<input type="hidden" asp-for="ClientId" />
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
2025-08-19 15:40:16 +01:00
<div class="form-group">
<div class="col-md-offset-2 col-md-10">
<div class="checkbox">
2025-08-24 16:07:53 +01:00
<input asp-for="Enabled" />
<label asp-for="Enabled"></label>
2025-08-19 15:40:16 +01:00
</div>
</div>
</div>
<div class="form-group">
2025-08-24 16:07:53 +01:00
<label asp-for="ClientName" class="col-md-2 control-label"></label>
2025-08-19 15:40:16 +01:00
<div class="col-md-10">
2025-08-24 16:07:53 +01:00
<input asp-for="ClientName" class="form-control" />
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<span asp-validation-for="ClientName" class="text-danger"></span>
2025-08-19 15:40:16 +01:00
</div>
</div>
<div class="form-group">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<label asp-for="Description" class="col-md-2 control-label"></label>
2025-08-19 15:40:16 +01:00
<div class="col-md-10">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<input asp-for="Description" class="form-control" />
<span asp-validation-for="Description" class="text-danger"></span>
2025-08-19 15:40:16 +01:00
</div>
</div>
<div class="form-group">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<label asp-for="ClientUri" class="col-md-2 control-label"></label>
2025-08-19 15:40:16 +01:00
<div class="col-md-10">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<input asp-for="ClientUri" class="form-control" />
<span asp-validation-for="ClientUri" class="text-danger"></span>
2025-08-19 15:40:16 +01:00
</div>
</div>
<div class="form-group">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<label asp-for="LogoUri" class="col-md-2 control-label"></label>
2025-08-19 15:40:16 +01:00
<div class="col-md-10">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<input asp-for="LogoUri" class="form-control" />
<span asp-validation-for="LogoUri" class="text-danger"></span>
2025-08-19 15:40:16 +01:00
</div>
</div>
<div class="form-group">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<label asp-for="ProtocolType" class="col-md-2 control-label"></label>
2025-08-19 15:40:16 +01:00
<div class="col-md-10">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<input asp-for="ProtocolType" class="form-control" />
<span asp-validation-for="ProtocolType" class="text-danger"></span>
2025-08-19 15:40:16 +01:00
</div>
</div>
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<fieldset>
<legend>Security</legend>
<div class="form-group">
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="RequireConsent" />
<label asp-for="RequireConsent"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="RequirePkce" />
<label asp-for="RequirePkce"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="RequireRequestObject" />
<label asp-for="RequireRequestObject"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="RequireClientSecret" />
<label asp-for="RequireClientSecret"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="AllowPlainTextPkce" />
<label asp-for="AllowPlainTextPkce"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="AllowOfflineAccess" />
<label asp-for="AllowOfflineAccess"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="AllowRememberConsent" />
<label asp-for="AllowRememberConsent"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="EnableLocalLogin" />
<label asp-for="EnableLocalLogin"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="AlwaysIncludeUserClaimsInIdToken" />
<label asp-for="AlwaysIncludeUserClaimsInIdToken"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="AlwaysSendClientClaims" />
<label asp-for="AlwaysSendClientClaims"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="IncludeJwtId" />
<label asp-for="IncludeJwtId"></label>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="UpdateAccessTokenClaimsOnRefresh" />
<label asp-for="UpdateAccessTokenClaimsOnRefresh"></label>
</div>
2025-08-24 16:07:53 +01:00
</div>
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
</fieldset>
<fieldset>
<legend>Logout</legend>
<div class="form-group">
<label asp-for="FrontChannelLogoutUri" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="FrontChannelLogoutUri" class="form-control" />
<span asp-validation-for="FrontChannelLogoutUri" class="text-danger"></span>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="FrontChannelLogoutSessionRequired" />
<label asp-for="FrontChannelLogoutSessionRequired"></label>
</div>
2025-08-19 15:40:16 +01:00
</div>
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<div class="form-group">
<label asp-for="BackChannelLogoutUri" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="BackChannelLogoutUri" class="form-control" />
<span asp-validation-for="BackChannelLogoutUri" class="text-danger"></span>
</div>
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="BackChannelLogoutSessionRequired" />
<label asp-for="BackChannelLogoutSessionRequired"></label>
</div>
</div>
</fieldset>
<fieldset>
<legend>Tokens</legend>
<div class="form-group">
<label asp-for="AccessTokenType" class="col-md-2 control-label"></label>
<div class="col-md-10">
@Html.DropDownList("AccessTokenType")
<span asp-validation-for="AccessTokenType" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="IdentityTokenLifetime" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="IdentityTokenLifetime" class="form-control" />
<span asp-validation-for="IdentityTokenLifetime" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="AccessTokenLifetime" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="AccessTokenLifetime" class="form-control" />
<span asp-validation-for="AccessTokenLifetime" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="AuthorizationCodeLifetime" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="AuthorizationCodeLifetime" class="form-control" />
<span asp-validation-for="AuthorizationCodeLifetime" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="AbsoluteRefreshTokenLifetime" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="AbsoluteRefreshTokenLifetime" class="form-control" />
<span asp-validation-for="AbsoluteRefreshTokenLifetime" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="SlidingRefreshTokenLifetime" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="SlidingRefreshTokenLifetime" class="form-control" />
<span asp-validation-for="SlidingRefreshTokenLifetime" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="RefreshTokenUsage" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="RefreshTokenUsage" class="form-control" />
<span asp-validation-for="RefreshTokenUsage" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="RefreshTokenExpiration" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="RefreshTokenExpiration" class="form-control" />
<span asp-validation-for="RefreshTokenExpiration" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="ConsentLifetime" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="ConsentLifetime" class="form-control" />
<span asp-validation-for="ConsentLifetime" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="UserSsoLifetime" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="UserSsoLifetime" class="form-control" />
<span asp-validation-for="UserSsoLifetime" class="text-danger"></span>
</div>
</div>
</fieldset>
<fieldset>
<legend>Device / CIBA</legend>
<div class="form-group">
<label asp-for="DeviceCodeLifetime" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="DeviceCodeLifetime" class="form-control" />
<span asp-validation-for="DeviceCodeLifetime" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="UserCodeType" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="UserCodeType" class="form-control" />
<span asp-validation-for="UserCodeType" class="text-danger"></span>
</div>
</div>
</fieldset>
<fieldset>
<legend>Tokens (extra)</legend>
<div class="form-group">
<label asp-for="AllowedIdentityTokenSigningAlgorithms" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="AllowedIdentityTokenSigningAlgorithms" class="form-control" />
<span asp-validation-for="AllowedIdentityTokenSigningAlgorithms" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<div class="col-md-offset-2 col-md-10 checkbox">
<input asp-for="AllowAccessTokensViaBrowser" />
<label asp-for="AllowAccessTokensViaBrowser"></label>
</div>
</div>
<div class="form-group">
<label asp-for="ClientClaimsPrefix" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="ClientClaimsPrefix" class="form-control" />
<span asp-validation-for="ClientClaimsPrefix" class="text-danger"></span>
</div>
</div>
<div class="form-group">
<label asp-for="PairWiseSubjectSalt" class="col-md-2 control-label"></label>
<div class="col-md-10">
<input asp-for="PairWiseSubjectSalt" class="form-control" />
<span asp-validation-for="PairWiseSubjectSalt" class="text-danger"></span>
</div>
</div>
</fieldset>
2025-08-19 15:40:16 +01:00
<div class="form-group">
<div class="col-md-offset-2 col-md-10">
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<input type="submit" value="Save" class="btn btn-primary" />
2025-08-19 15:40:16 +01:00
</div>
</div>
</div>
</form>
yavsc-org: OAuth2 client admin editor overhaul — per-collection pages + missing fields The OAuth2 client editor at /Client/Edit/{id} previously exposed 8 fields out of ~30 scalars and 10 collections on the IdentityServer8 Client entity. Editing the collections (RedirectUris, Scopes, Grant Types, Cors Origins, IdP Restrictions, Claims, Properties, Secrets) was either impossible or jammed into a single broken text input that bound against an IEnumerable<string> property. Restructure into per-collection subpages, each with its own list/add/remove flow: - RedirectUris /Client/EditRedirectUris/{id} - PostLogoutRedirectUris /Client/EditPostLogoutRedirectUris/{id} - Scopes /Client/EditScopes/{id} - GrantTypes /Client/EditGrantTypes/{id} - CorsOrigins /Client/EditCorsOrigins/{id} - IdPRestrictions /Client/EditIdPRestrictions/{id} - Claims /Client/EditClaims/{id} - Properties /Client/EditProperties/{id} - Secrets /Client/EditSecrets/{id} Implementation: - New partial class ClientController.Collections.cs with one GET/Add/Remove trio per collection. Add/Remove dispatch through generic helpers that handle the EF row + ClientId check. - Shared _EditableStringList.cshtml partial consumed by the six single-string-field collection pages. Uses reflection to pull the value field and the row Id off the entity — avoids six nearly-identical table+form copies. - Claims / Properties / Secrets each have their own view because they carry 2+ fields (Type+Value, Key+Value, or Type+Value+Description+Expiration). - Main Edit.cshtml enriched: ClientId/Id hidden, all scalar fields split into fieldsets (Core, Security, Logout, Tokens, Device flow, Tokens extra), nav links to the 9 subpages with current row counts as badges. - ClientController.Edit(int) GET now loads the client with all navigations via LoadClientAsync so the Edit.cshtml nav badges render real counts. Field-correctness notes (verified by disassembling HigginsSoft IdentityServer8.EntityFramework.Entities.Client 8.0.5-preview-net9): - The property is PairWiseSubjectSalt, not PairwiseSubjectSalt (capital W on 'Wise'). - CibaLifetime and PollingInterval do NOT exist on Client in this IdentityServer8 version — those properties were a guess. The Device flow fieldset contains DeviceCodeLifetime + UserCodeType instead. - AllowedIdentityTokenSigningAlgorithms and AllowAccessTokensViaBrowser were missing from the original form and are now exposed. - ConsentLifetime and UserSsoLifetime are int? (nullable); the form binds them as plain int fields which accept empty strings. Security: - All new actions stay under [Authorize('AdministratorOnly')]. - Each Add/Remove takes an explicit id (Client.Id) and the row's ClientId is checked on the server before any delete; a rowId from another client returns NotFound. Docs: - doc/dev-tracking/client-editor-overhaul.md — inventory, status, follow-up ideas (confirmation prompts, validation, MVC tests).
2026-06-21 16:53:34 +01:00
<hr />
<h3>Collections</h3>
<p class="text-muted">
The following pages edit collections of related rows for this client.
</p>
<div class="list-group">
<a asp-action="EditRedirectUris" asp-route-id="@Model.Id" class="list-group-item">
Redirect URIs <span class="badge">@Model.RedirectUris.Count</span>
</a>
<a asp-action="EditPostLogoutRedirectUris" asp-route-id="@Model.Id" class="list-group-item">
Post-logout Redirect URIs <span class="badge">@Model.PostLogoutRedirectUris.Count</span>
</a>
<a asp-action="EditScopes" asp-route-id="@Model.Id" class="list-group-item">
Allowed Scopes <span class="badge">@Model.AllowedScopes.Count</span>
</a>
<a asp-action="EditGrantTypes" asp-route-id="@Model.Id" class="list-group-item">
Allowed Grant Types <span class="badge">@Model.AllowedGrantTypes.Count</span>
</a>
<a asp-action="EditCorsOrigins" asp-route-id="@Model.Id" class="list-group-item">
Allowed CORS Origins <span class="badge">@Model.AllowedCorsOrigins.Count</span>
</a>
<a asp-action="EditIdPRestrictions" asp-route-id="@Model.Id" class="list-group-item">
Identity Provider Restrictions <span class="badge">@Model.IdentityProviderRestrictions.Count</span>
</a>
<a asp-action="EditClaims" asp-route-id="@Model.Id" class="list-group-item">
Client Claims <span class="badge">@Model.Claims.Count</span>
</a>
<a asp-action="EditProperties" asp-route-id="@Model.Id" class="list-group-item">
Client Properties <span class="badge">@Model.Properties.Count</span>
</a>
<a asp-action="EditSecrets" asp-route-id="@Model.Id" class="list-group-item">
Client Secrets <span class="badge">@(Model.ClientSecrets?.Count ?? 0)</span>
</a>
</div>
2025-08-19 15:40:16 +01:00
<div>
2026-02-22 23:39:56 +00:00
<a asp-action="Index">@Localizer["Back to List"]</a>
2026-07-04 20:03:56 +01:00
</div>