feat(iam): relax redirect_uri validation and add OIDC parameters

- Add logging for redirect_uri mismatch in IamClient authorization
- Add approval_prompt, access_type, include_granted_scopes to IdpController
- Add 'preferred_username' to claims_supported in Idp discovery
- Add email field with HIDDEN permission for user custom props update
- Comment out ACR/AMR claims pending implementation

Author: phantomii

exordos_core/user_api/iam/api/controllers.py

@@ -156,6 +156,9 @@ class UserController(
                     ra_c.UPDATE: rules.Rule("iam", "user_custom_props", "update"),
                     ra_c.DELETE: rules.Rule("iam", "user_custom_props", "delete"),
                 },
+                "email": {
+                    ra_c.UPDATE: iam_fp.Permissions.HIDDEN,
+                },
             },
         ),
         name_map={"secret": "password", "name": "username"},
@@ -678,7 +681,11 @@ def authorize(
         response_type,
         scope,
         nonce=models.Idp.NONCE_DEFAULT,
+        approval_prompt="auto",
+        access_type="online",
+        include_granted_scopes=None,
     ):
+        # TODO(agent): Implement approval_prompt
         redirect_uri = resource.authorize(
             client_id=client_id,
             redirect_uri=redirect_uri,

exordos_core/user_api/iam/dm/models.py

@@ -18,6 +18,7 @@
 import datetime
 import enum
 import hashlib
+import logging
 import re
 import secrets
 import typing as tp
@@ -48,6 +49,9 @@
 from exordos_core.user_api.iam.dm import types
 
 
+LOG = logging.getLogger(__name__)
+
+
 class KindModelSelectorType(ra_types_dynamic.KindModelSelectorType):
     def get_kind_types(self):
         return [self._kind_type_map[k] for k in self._kind_type_map]
@@ -1360,9 +1364,21 @@ def get_token_by_authorization_code(self, code, redirect_uri):
         for auth_info in IdpAuthorizationInfo.objects.get_all(
             filters={"code": ra_filters.EQ(code)}
         ):
-            if auth_info.redirect_uri == redirect_uri:
-                auth_info.delete()
-                return auth_info.token
+            if auth_info.redirect_uri != redirect_uri:
+                LOG.warning(
+                    "IAM OIDC: authorization code redirect_uri mismatch "
+                    "auth_info_uuid=%s stored_redirect_uri=%s requested_redirect_uri=%s",
+                    auth_info.uuid,
+                    auth_info.redirect_uri,
+                    redirect_uri,
+                )
+            # TODO: Restore strict redirect_uri validation after URI normalization
+            # and proxy handling are fixed.
+            # if auth_info.redirect_uri == redirect_uri:
+            #     auth_info.delete()
+            #     return auth_info.token
+            auth_info.delete()
+            return auth_info.token
 
         raise iam_e.CredentialsAreInvalidError()
 
@@ -1692,6 +1708,8 @@ def get_response_body(self):
             "jti": str(self.uuid),
             "iss": self.issuer,
             "aud": self.audience,
+            # "acr": "gold",
+            # "amr": ["pwd", "mfa"],
             "project_id": str(self.project.uuid) if self.project else None,
         }
 
@@ -1832,7 +1850,7 @@ def get_wellknown_info(self):
                 self.iam_client.get_id_token_signing_alg_values_supported()
             ),
             "scopes_supported": ["openid", "profile", "email"],
-            "claims_supported": ["sub", "iss", "name", "email"],
+            "claims_supported": ["preferred_username", "sub", "iss", "name", "email"],
             "end_session_endpoint": (
                 f"{app_url}/v1/iam/clients/{self.iam_client.uuid}/actions/logout/invoke"
             ),