feat(core): enforce application access during OIDC flows

[charIeszhao]

Summary

Enforce application-level access control during OIDC authorization and token continuation flows. The PR adds enforcement before consent auto-completion, before consent grant persistence, while loading existing authorization grants, and before issuing new tokens from refresh token or token exchange grants.

Testing

Unit tests

Checklist

• .changeset
• unit tests
• integration tests
• necessary TSDoc comments

[github-actions]

COMPARE TO master

Total Size Diff ⚠️ 📈 +24.1 KB

Diff by File

Name	Diff
packages/core/src/libraries/application-access-control.test.ts	📈 +380 Bytes
packages/core/src/libraries/application-access-control.ts	📈 +65 Bytes
packages/core/src/libraries/session/consent.test.ts	📈 +1 KB
packages/core/src/libraries/session/consent.ts	📈 +535 Bytes
packages/core/src/libraries/session/session-context.test.ts	📈 +29 Bytes
packages/core/src/middleware/koa-app-access-control.test.ts	📈 +3.88 KB
packages/core/src/middleware/koa-app-access-control.ts	📈 +1.24 KB
packages/core/src/middleware/koa-auto-consent.ts	📈 +196 Bytes
packages/core/src/middleware/koa-consent-guard.test.ts	📈 +395 Bytes
packages/core/src/middleware/koa-consent-guard.ts	📈 +103 Bytes
packages/core/src/oidc/application-access-control.ts	📈 +2.02 KB
packages/core/src/oidc/grants/index.ts	📈 +160 Bytes
packages/core/src/oidc/grants/refresh-token.test.ts	📈 +741 Bytes
packages/core/src/oidc/grants/refresh-token.ts	📈 +334 Bytes
packages/core/src/oidc/grants/token-exchange/index.test.ts	📈 +981 Bytes
packages/core/src/oidc/grants/token-exchange/index.ts	📈 +349 Bytes
packages/core/src/oidc/init.test.ts	📈 +5.46 KB
packages/core/src/oidc/init.ts	📈 +1.15 KB
packages/core/src/routes/interaction/consent/index.ts	📈 +161 Bytes
packages/core/src/tenants/Tenant.ts	📈 +236 Bytes
packages/integration-tests/src/api/application.ts	📈 +310 Bytes
packages/integration-tests/src/client/index.ts	📈 +83 Bytes
packages/integration-tests/src/tests/api/application-access-control.test.ts	📈 +5.39 KB

[Copilot]

Pull request overview

This PR enforces application-level access control across several OIDC flow touchpoints (consent handling, loading existing grants, and token issuance via refresh token / token exchange), building on the access evaluator introduced in #8879.

Changes:

• Enforce application access before consent auto-completion and before persisting consent grants.
• Enforce application access when loading an existing authorization grant in OIDC.
• Enforce application access before issuing tokens from refresh-token and token-exchange grants, with new unit tests.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/core/src/tenants/Tenant.ts	Adds app-access-control middleware into the experience consent route pipeline.
packages/core/src/routes/interaction/consent/index.ts	Passes applicationAccessControl into consent() calls.
packages/core/src/oidc/init.ts	Adds loadExistingGrant hook + wires libraries into registerGrants.
packages/core/src/oidc/grants/index.ts	Extends registerGrants signature to pass applicationAccessControl into grant handlers.
packages/core/src/oidc/grants/refresh-token.ts	Enforces app access before refresh token rotation.
packages/core/src/oidc/grants/refresh-token.test.ts	Adds unit coverage for access-denied behavior during refresh.
packages/core/src/oidc/grants/token-exchange/index.ts	Enforces app access before token continuation is created.
packages/core/src/oidc/grants/token-exchange/index.test.ts	Adds unit coverage for access-denied behavior during token exchange.
packages/core/src/middleware/koa-auto-consent.ts	Threads libraries into consent() so consent() can enforce app access.
packages/core/src/middleware/koa-app-access-control.ts	New middleware to enforce app access for experience /consent route.
packages/core/src/middleware/koa-app-access-control.test.ts	Unit tests for the new middleware.
packages/core/src/libraries/session/consent.ts	Adds access enforcement before creating/saving consent grant.
packages/core/src/libraries/session/consent.test.ts	Updates tests + adds assertion that access check happens before grant save.
packages/core/src/libraries/session/session-context.test.ts	Updates consent() invocation with applicationAccessControl dependency.
packages/core/src/libraries/application-access-control.ts	Skips enforcement for built-in applications.
packages/core/src/libraries/application-access-control.test.ts	Adds coverage for built-in application bypass.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[simeng-li]

Could also introduce some integration tests

[charIeszhao]

Added integration coverage for app-level access enforcement in the consent step and refresh-token exchange, covering the denied-user path and the OAuth access_denied token response.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

[simeng-li]

LGTM