From eba44b46e2e0c9cc04d2a218bab1f3dca630d266 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 12 Jul 2026 15:51:55 +0100
Subject: [PATCH] postit: allow self-signed OIDC TLS in Development

---
 src/PostIt/PostIt/ViewModels/Settings.cs | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/PostIt/PostIt/ViewModels/Settings.cs b/src/PostIt/PostIt/ViewModels/Settings.cs
index 5bd3a844..9d556712 100644
--- a/src/PostIt/PostIt/ViewModels/Settings.cs
+++ b/src/PostIt/PostIt/ViewModels/Settings.cs
@@ -6,6 +6,7 @@ using Microsoft.Extensions.DependencyInjection;
 using System;
 using System.Collections.Generic;
 using System.IO;
+using System.Net.Http;
 using System.Text.Json;
 using System.Threading;
 
@@ -182,6 +183,16 @@ public partial class Settings : ViewModelBase
                 // PKCE is enabled by default when no client_secret is provided.
             };
 
+            if (IsDevelopmentEnvironment())
+            {
+                // Dev only: allow local/self-signed TLS for discovery/token
+                // endpoints when the machine does not trust a custom root.
+                options.BackchannelHandler = new HttpClientHandler
+                {
+                    ServerCertificateCustomValidationCallback = (_, _, _, _) => true
+                };
+            }
+
             if (browser is not null)
                 options.Browser = browser;
 
@@ -231,6 +242,14 @@ public partial class Settings : ViewModelBase
         }
     }
 
+    private static bool IsDevelopmentEnvironment()
+    {
+        return string.Equals(
+            Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT"),
+            "Development",
+            StringComparison.OrdinalIgnoreCase);
+    }
+
     internal void Load()
     {
         if (Loaded) return;