fix(admin-api): omit clientSecret from getConfig response for security & add OIDC scope.

2025-05-08 11:39:44 -04:00
parent 8c70783d5a
commit 2f391d11db
6 changed files with 148 additions and 129 deletions
--- a/src/controllers/AuthController.php
+++ b/src/controllers/AuthController.php
@@ -111,6 +111,8 @@ class AuthController
                $cfg['oidc']['clientSecret']
            );
            $oidc->setRedirectURL($cfg['oidc']['redirectUri']);
+            $oidc->addScope(['openid','profile','email']);
+

            if ($oidcAction === 'callback') {
                try {