feat(core,console): support blocking token issuance on jwt customizer errors by darcyYe · Pull Request #8426 · logto-io/logto

darcyYe · 2026-03-04T10:16:39Z

Summary

add blockIssuanceOnError to the JWT customizer config, schema, and OpenAPI surface for both access tokens and client credentials
preserve api.denyAccess() as access_denied while converting other JWT customizer runtime failures in blocking mode into localized OIDC invalid_request responses
default blockIssuanceOnError to enabled for newly created custom claims scripts in the console, while keeping existing scripts without a saved value on the legacy disabled default to avoid a breaking change
localize the custom claims script error prefix and the console error-handling hint across supported locales, and clean up the console action typing with a shared Action enum
update the core, schema, console, and integration coverage for blocking token issuance behavior in token exchange and client credentials flows

Testing

Unit tests, Integration tests

Checklist

.changeset
unit tests
integration tests
necessary TSDoc comments

github-actions · 2026-03-04T10:16:59Z

COMPARE TO `master`

Total Size Diff ⚠️ 📈 +36.92 KB

Diff by File

Name	Diff
.changeset/pink-lemons-boil.md	📈 +841 Bytes
packages/console/package.json	📈 +67 Bytes
packages/console/src/assets/icons/error-handling.svg	📈 +646 Bytes
packages/console/src/pages/CustomizeJwt/CreateButton/index.tsx	📈 +63 Bytes
packages/console/src/pages/CustomizeJwt/CustomizerItem/index.tsx	📈 +63 Bytes
packages/console/src/pages/CustomizeJwt/utils/type.ts	📈 +21 Bytes
packages/console/src/pages/CustomizeJwtDetails/MainContent/SettingsSection/InstructionTab/GuideCard/index.tsx	📈 +36 Bytes
packages/console/src/pages/CustomizeJwtDetails/MainContent/SettingsSection/InstructionTab/index.tsx	📈 +2.7 KB
packages/console/src/pages/CustomizeJwtDetails/MainContent/SettingsSection/index.tsx	📈 +807 Bytes
packages/console/src/pages/CustomizeJwtDetails/MainContent/index.tsx	📈 +126 Bytes
packages/console/src/pages/CustomizeJwtDetails/index.tsx	📈 +50 Bytes
packages/console/src/pages/CustomizeJwtDetails/type.ts	📈 +17 Bytes
packages/console/src/pages/CustomizeJwtDetails/use-data-fetch.ts	📈 +50 Bytes
packages/console/src/pages/CustomizeJwtDetails/utils/format.test.ts	📈 +1.86 KB
packages/console/src/pages/CustomizeJwtDetails/utils/format.ts	📈 +246 Bytes
packages/core/src/middleware/koa-oidc-error-handler.test.ts	📈 +375 Bytes
packages/core/src/oidc/extra-token-claims.test.ts	📈 +1.6 KB
packages/core/src/oidc/extra-token-claims.ts	📈 +1.37 KB
packages/core/src/routes/logto-config/jwt-customizer.test.ts	📈 +12 Bytes
packages/core/src/routes/logto-config/logto-config.openapi.json	📈 +344 Bytes
packages/integration-tests/src/mocks/jwt-customizer.ts	📈 +31 Bytes
packages/integration-tests/src/tests/api/oidc/client-credentials-grant.test.ts	📈 +1.94 KB
packages/integration-tests/src/tests/api/oidc/token-exchange/index.test.ts	📈 +3.65 KB
packages/phrases/src/locales/ar/errors/oidc.ts	📈 +93 Bytes
packages/phrases/src/locales/ar/translation/admin-console/jwt-claims.ts	📈 +1.31 KB
packages/phrases/src/locales/de/errors/oidc.ts	📈 +100 Bytes
packages/phrases/src/locales/de/translation/admin-console/jwt-claims.ts	📈 +1.02 KB
packages/phrases/src/locales/en/errors/oidc.ts	📈 +83 Bytes
packages/phrases/src/locales/en/translation/admin-console/jwt-claims.ts	📈 +863 Bytes
packages/phrases/src/locales/es/errors/oidc.ts	📈 +98 Bytes
packages/phrases/src/locales/es/translation/admin-console/jwt-claims.ts	📈 +1.02 KB
packages/phrases/src/locales/fr/errors/oidc.ts	📈 +99 Bytes
packages/phrases/src/locales/fr/translation/admin-console/jwt-claims.ts	📈 +1.07 KB
packages/phrases/src/locales/it/errors/oidc.ts	📈 +106 Bytes
packages/phrases/src/locales/it/translation/admin-console/jwt-claims.ts	📈 +1.04 KB
packages/phrases/src/locales/ja/errors/oidc.ts	📈 +101 Bytes
packages/phrases/src/locales/ja/translation/admin-console/jwt-claims.ts	📈 +1.25 KB
packages/phrases/src/locales/ko/errors/oidc.ts	📈 +93 Bytes
packages/phrases/src/locales/ko/translation/admin-console/jwt-claims.ts	📈 +1 KB
packages/phrases/src/locales/pl-pl/errors/oidc.ts	📈 +95 Bytes
packages/phrases/src/locales/pl-pl/translation/admin-console/jwt-claims.ts	📈 +984 Bytes
packages/phrases/src/locales/pt-br/errors/oidc.ts	📈 +96 Bytes
packages/phrases/src/locales/pt-br/translation/admin-console/jwt-claims.ts	📈 +1002 Bytes
packages/phrases/src/locales/pt-pt/errors/oidc.ts	📈 +96 Bytes
packages/phrases/src/locales/pt-pt/translation/admin-console/jwt-claims.ts	📈 +1009 Bytes
packages/phrases/src/locales/ru/errors/oidc.ts	📈 +124 Bytes
packages/phrases/src/locales/ru/translation/admin-console/jwt-claims.ts	📈 +1.51 KB
packages/phrases/src/locales/th/errors/oidc.ts	📈 +131 Bytes
packages/phrases/src/locales/th/translation/admin-console/jwt-claims.ts	📈 +1.87 KB
packages/phrases/src/locales/tr-tr/errors/oidc.ts	📈 +85 Bytes
packages/phrases/src/locales/tr-tr/translation/admin-console/jwt-claims.ts	📈 +1020 Bytes
packages/phrases/src/locales/zh-cn/errors/oidc.ts	📈 +87 Bytes
packages/phrases/src/locales/zh-cn/translation/admin-console/jwt-claims.ts	📈 +856 Bytes
packages/phrases/src/locales/zh-hk/errors/oidc.ts	📈 +84 Bytes
packages/phrases/src/locales/zh-hk/translation/admin-console/jwt-claims.ts	📈 +856 Bytes
packages/phrases/src/locales/zh-tw/errors/oidc.ts	📈 +84 Bytes
packages/phrases/src/locales/zh-tw/translation/admin-console/jwt-claims.ts	📈 +856 Bytes
packages/schemas/src/types/logto-config/jwt-customizer.test.ts	📈 +103 Bytes
packages/schemas/src/types/logto-config/jwt-customizer.ts	📈 +48 Bytes

simeng-li

core changes LGTM

oidc-provider AccessDenied defaults to 400, which changes the existing custom JWT denyAccess behavior. Keep api.denyAccess as the access_denied exception when blockIssuanceOnError is enabled by preserving the original 403 status in the custom JWT error path.

gao-sun

lgtm on changeset

github-actions Bot added the feature Cool stuff label Mar 4, 2026

github-actions Bot added the size/xl label Mar 4, 2026

github-actions Bot assigned darcyYe Mar 4, 2026

darcyYe force-pushed the yemq-jwt-customizer-block-issuance-on-error branch from d29a91e to fd3bdf5 Compare March 11, 2026 08:51

github-actions Bot added size/xl and removed size/xl labels Mar 11, 2026

darcyYe force-pushed the yemq-jwt-customizer-block-issuance-on-error branch from 9a86acf to 402def3 Compare March 12, 2026 04:11

github-actions Bot added size/xl and removed size/xl labels Mar 12, 2026

darcyYe force-pushed the yemq-jwt-customizer-block-issuance-on-error branch from 402def3 to 617a3a8 Compare March 24, 2026 03:22

github-actions Bot added size/xl and removed size/xl labels Mar 24, 2026

darcyYe marked this pull request as ready for review March 24, 2026 04:37

darcyYe requested review from charIeszhao, gao-sun, wangsijie and xiaoyijun as code owners March 24, 2026 04:37

charIeszhao reviewed Mar 27, 2026

View reviewed changes

Comment thread ...s/console/src/pages/CustomizeJwtDetails/MainContent/SettingsSection/InstructionTab/index.tsx

charIeszhao approved these changes Mar 27, 2026

View reviewed changes

simeng-li approved these changes Mar 27, 2026

View reviewed changes

github-actions Bot removed the size/xl label Mar 28, 2026

darcyYe added 25 commits March 31, 2026 23:20

feat(core): support blocking token issuance on jwt customizer errors

4f89a8d

fix(console): show custom jwt warning as alert

3117feb

fix(console): sync jwt guide card expansion animation

3059345

fix(core): expose jwt customizer script errors

67dcf31

fix(phrases): localize custom claims script errors

2ea675f

fix(phrases): localize jwt claims error handling copy

42fd018

fix(core): avoid escaping jwt customizer errors

84ad8d6

fix(test): align jwt customizer error expectations

c0e8ca0

fix(test): address token exchange lint error

8d4828f

feat(console): move jwt error handling to separate tab

226bcc7

fix(console): keep jwt settings tabs mounted

d997677

revert(console): restore jwt guide card css expansion

9778f1d

fix(console): generate jwt type definitions before tests

18584cd

test(console): remove jwt settings section test

d4e0862

chore: update jwt customizer changeset

e65ba25

refactor(core,console): address jwt customizer review comments

29020ed

refactor(core): simplify jwt customizer access denied handling

d31bbe0

fix(core): keep jwt customizer access denied at default status

202e60f

refactor(console): merge jwt data source section guards

5898bdc

fix(console): default block issuance on error for new custom jwt scripts

c8fa3b2

chore(console): merge jwt customizer changesets

f919062

fix(console): resolve jwt customizer lint errors

dbabaf6

fix(console): restore import grouping in jwt formatter test

1a67e19

fix(console): revert jest svg react mapper

1aa8bce

gao-sun approved these changes Apr 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(core,console): support blocking token issuance on jwt customizer errors#8426

feat(core,console): support blocking token issuance on jwt customizer errors#8426
darcyYe merged 25 commits intomasterfrom
yemq-jwt-customizer-block-issuance-on-error

darcyYe commented Mar 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

simeng-li left a comment

Uh oh!

gao-sun left a comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

darcyYe commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Checklist

Uh oh!

github-actions Bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

COMPARE TO master

Uh oh!

Uh oh!

simeng-li left a comment

Choose a reason for hiding this comment

Uh oh!

gao-sun left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

darcyYe commented Mar 4, 2026 •

edited

Loading

github-actions Bot commented Mar 4, 2026 •

edited

Loading

COMPARE TO `master`