OAuthClientMetadata is serialized directly into the client-metadata
document served at the client_id URL, but every unset optional property
was written as JSON null. The AT Protocol OAuth spec distinguishes
absent from null, and the reference @atproto/oauth-provider rejects such
a document with invalid_client_metadata, so PAR failed for any app that
served Results.Json(metadata).

Annotate every optional property on OAuthClientMetadata and the nested
JsonWebKey with [JsonIgnore(Condition = WhenWritingNull)], so the
document is spec-compliant under any JsonSerializerOptions — including
the ASP.NET Core defaults — with no consumer change. Add
OAuthClientMetadata.ToJson(writeIndented) for serving the document
directly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

claude-bot referenced this pull request

2026-07-25 02:32:05 +00:00

OAuthClientMetadata serializes unset optional fields as null — auth servers reject the client-metadata document (invalid_client_metadata) #41

claude-bot commented

2026-07-25 02:32:46 +00:00

Author

Collaborator

🤖 Reviewing this PR — follow along in the action run; the reply will link the full session transcript.

🤖 Reviewing this PR — follow along in [the action run](https://git.grandiras.net/Grandiras/claude-bot/actions/runs/45); the reply will link the full session transcript.

Grandiras merged commit 1f3181876c into main

2026-07-25 02:36:45 +00:00

Grandiras deleted branch claude/issue-41

2026-07-25 02:36:46 +00:00

Grandiras referenced this pull request from a commit

2026-07-25 02:36:47 +00:00

Claude: changes for issue #41 (#58)

claude-bot referenced this pull request

2026-07-25 02:42:48 +00:00

Claude: changes for issue #39 #59

claude-bot commented

2026-07-25 14:35:18 +00:00

Author

Collaborator

📝 Retroactive review summary (was stuck as an invisible draft by the APPROVE/APPROVED bug, fixed in v12.2 — verdict was: approve):

Clean, well-scoped fix. Every optional nullable property on OAuthClientMetadata and the nested JsonWebKey now carries [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)], matching the spec requirement that unset fields be absent rather than null — verified none were missed by re-reading the pre-change model. The new ToJson() convenience method and its dedicated JsonSerializerOptions are correct and side-step consumer serializer config entirely. Tests cover: default-options serialization (the actual bug scenario via Results.Json), ToJson() both compact and indented, and the nested jwks/JsonWebKey omission. Docs (oauth.md) and CHANGELOG.md are updated in the same commit per repo convention. No correctness, security, or omission issues found.

⏱ 0m 24s · 5 turns · tokens: 23.0k in / 1.6k out (+205.0k cache-read)
📜 Full session transcript

📝 **Retroactive review summary** (was stuck as an invisible draft by the APPROVE/APPROVED bug, fixed in v12.2 — verdict was: approve): Clean, well-scoped fix. Every optional nullable property on `OAuthClientMetadata` and the nested `JsonWebKey` now carries `[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]`, matching the spec requirement that unset fields be absent rather than `null` — verified none were missed by re-reading the pre-change model. The new `ToJson()` convenience method and its dedicated `JsonSerializerOptions` are correct and side-step consumer serializer config entirely. Tests cover: default-options serialization (the actual bug scenario via `Results.Json`), `ToJson()` both compact and indented, and the nested `jwks`/`JsonWebKey` omission. Docs (`oauth.md`) and `CHANGELOG.md` are updated in the same commit per repo convention. No correctness, security, or omission issues found. --- ⏱ 0m 24s · 5 turns · tokens: 23.0k in / 1.6k out (+205.0k cache-read) 📜 [Full session transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/ATProto.NET/pr-58/run-45.md)