From f7bf96eef556bf3e50d115402b239f81b66733a9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 18 Jul 2026 18:57:15 +0000
Subject: [PATCH] fix: avoid exposing validation details in oauth client
 registration errors

---
 app/apps/common/oauth_views.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/app/apps/common/oauth_views.py b/app/apps/common/oauth_views.py
index 5eda6a0..b508eb1 100644
--- a/app/apps/common/oauth_views.py
+++ b/app/apps/common/oauth_views.py
@@ -1,5 +1,6 @@
 import hmac
 import json
+import logging
 import time
 from secrets import token_urlsafe
 
@@ -12,6 +13,7 @@ from oauth2_provider.models import get_application_model
 
 
 Application = get_application_model()
+logger = logging.getLogger(__name__)
 
 SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS = {
     "none": Application.CLIENT_PUBLIC,
@@ -145,7 +147,8 @@ def dynamic_client_registration(request):
             default=["code"],
         )
     except ValueError as exc:
-        return _json_error("invalid_client_metadata", str(exc))
+        logger.warning("Invalid dynamic client registration payload: %s", exc)
+        return _json_error("invalid_client_metadata", "Client metadata is invalid.")
 
     unsupported_grant_types = sorted(set(grant_types) - SUPPORTED_GRANT_TYPES)
     if unsupported_grant_types:
@@ -223,12 +226,10 @@ def dynamic_client_registration(request):
     try:
         application.full_clean()
     except ValidationError as exc:
-        errors = []
-        for field, messages in exc.message_dict.items():
-            errors.extend(f"{field}: {message}" for message in messages)
+        logger.warning("Dynamic client registration validation failed: %s", exc)
         return _json_error(
             "invalid_client_metadata",
-            "; ".join(errors),
+            "Client metadata is invalid.",
         )
 
     application.save()