Fix OIDC: Allow ports in redirect_uri for loopback addresses

crates/http/src/auth/oauth/auth.rs

@@ -16,6 +16,7 @@ use common::{
             CLIENT_ID_MAX_LEN, DEVICE_CODE_LEN, SUPPORTED_SCOPES, USER_CODE_ALPHABET,
             USER_CODE_LEN,
             client_id::{decode_client_id, scopes_to_mask},
+            registration::redirect_uri_matches,
         },
     },
 };
@@ -569,27 +570,6 @@ impl OAuthApiHandler for Server {
     }
 }
 
-fn redirect_uri_matches(registered: &str, presented: &str) -> bool {
-    registered == presented || loopback_redirect_matches(registered, presented)
-}
-
-fn loopback_redirect_matches(registered: &str, presented: &str) -> bool {
-    for host in ["http://127.0.0.1", "http://[::1]"] {
-        if let (Some(reg_path), Some(pres_rest)) =
-            (registered.strip_prefix(host), presented.strip_prefix(host))
-            && let Some(after_port) = pres_rest.strip_prefix(':')
-            && let Some(slash) = after_port.find('/')
-        {
-            let (port, pres_path) = after_port.split_at(slash);
-            if !port.is_empty() && port.bytes().all(|b| b.is_ascii_digit()) && pres_path == reg_path
-            {
-                return true;
-            }
-        }
-    }
-    false
-}
-
 fn grant_scope(requested: Option<&str>, registered_mask: u64) -> Option<String> {
     let mut granted = String::new();
     for scope in requested.unwrap_or_default().split_ascii_whitespace() {

crates/http/src/auth/oauth/registration.rs

@@ -14,7 +14,8 @@ use common::{
             client_id::{ClientMeta, decode_client_id, encode_client_id, scopes_to_mask},
             registration::{
                 ClientRegistrationError, ClientRegistrationRequest, ClientRegistrationResponse,
-                TokenEndpointAuthMethod, validate_grant_metadata, validate_redirect_uri,
+                TokenEndpointAuthMethod, redirect_uri_matches, validate_grant_metadata,
+                validate_redirect_uri,
             },
         },
     },
@@ -247,7 +248,11 @@ impl ClientRegistrationHandler for Server {
                             .caused_by(trc::location!())
                             .ctx(trc::Key::Id, client_id.id().id())
                     })?;
-                if client.redirect_uris.iter().any(|uri| uri == redirect_uri) {
+                if client
+                    .redirect_uris
+                    .iter()
+                    .any(|uri| redirect_uri_matches(uri, redirect_uri))
+                {
                     return Ok(None);
                 }
             } else {