Add Zoom to the list of supported providers

Directory.Build.targets

@@ -123,7 +123,7 @@
   
   <!--
     Note: Arcade always generates .resx backing files with internal static methods/constants.
-    To ensure the OpenIddict resources are public, the default visibility is manually overriden.
+    To ensure the OpenIddict resources are public, the default visibility is manually overridden.
   -->
 
   <Target Name="OverrideResourcesVisibility" Condition=" @(EmbeddedResourceSGResx) != '' " AfterTargets="_GenerateResxSource">

gen/OpenIddict.Client.WebIntegration.Generators/OpenIddictClientWebIntegrationGenerator.cs

@@ -1165,7 +1165,7 @@ public sealed partial class OpenIddictClientWebIntegrationConfiguration
                                             _ => (IList<string>) Array.Empty<string>()
                                         },
 
-                                        DeviceAuthorizationEndpointAuthMethodsSupported = configuration.Elements("DeviceAuthorizationEndpointAuthMethodsSupported").ToList() switch
+                                        DeviceAuthorizationEndpointAuthMethodsSupported = configuration.Elements("DeviceAuthorizationEndpointAuthMethod").ToList() switch
                                         {
                                             { Count: > 0 } methods => methods.Select(type => (string?) type.Attribute("Value")).ToList(),
 

shared/OpenIddict.Extensions/Helpers/OpenIddictHelpers.cs

@@ -478,7 +478,7 @@ internal static class OpenIddictHelpers
 
         // Note: on .NET Framework, the RSA.Create() overload uses CryptoConfig.CreateFromName()
         // and always returns a RSACryptoServiceProvider instance unless the default name mapping was
-        // explicitly overriden in machine.config or via CryptoConfig.AddAlgorithm(). Unfortunately,
+        // explicitly overridden in machine.config or via CryptoConfig.AddAlgorithm(). Unfortunately,
         // RSACryptoServiceProvider still uses 1024-bit keys by default and doesn't support changing
         // the key size via RSACryptoServiceProvider.KeySize (setting it has no effect on the object).
         //

src/OpenIddict.Client.DataProtection/OpenIddictClientDataProtectionHandlers.Protection.cs

@@ -178,7 +178,7 @@ public static partial class OpenIddictClientDataProtectionHandlers
                 // of the default token format (typically, JSON Web Token). By default, Data Protection
                 // is automatically used for all the supported token types once the integration is enabled
                 // but the default token format can be re-enabled in the options. Alternatively, the token
-                // format can be overriden manually using a custom event handler registered after this one.
+                // format can be overridden manually using a custom event handler registered after this one.
 
                 context.TokenFormat = context.TokenType switch
                 {

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Discovery.cs

@@ -250,7 +250,7 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                 }
 
                 // Google doesn't properly implement the device authorization grant, doesn't support
-                // client authentication method for the device authorization endpoint and returns a
+                // basic client authentication for the device authorization endpoint and returns a
                 // generic "invalid_request" request when using "client_secret_basic" instead of
                 // sending the client identifier in the request form. To work around this limitation,
                 // "client_secret_post" is listed as the only supported client authentication method.
@@ -351,10 +351,9 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                 // While PayPal supports OpenID Connect discovery, the configuration document returned
                 // by the sandbox environment always contains the production endpoints, which would
                 // prevent the OpenIddict integration from working properly when using the sandbox mode.
-                // To work around that, the endpoints are manually overriden when this environment is used.
+                // To work around that, the endpoints are manually overridden when this environment is used.
                 else if (context.Registration.ProviderType is ProviderTypes.PayPal &&
-                    context.Registration.GetPayPalSettings() is { Environment: string environment } &&
-                    string.Equals(environment, PayPal.Environments.Sandbox, StringComparison.OrdinalIgnoreCase))
+                    context.Registration.GetPayPalSettings() is { Environment: PayPal.Environments.Sandbox })
                 {
                     context.Configuration.AuthorizationEndpoint =
                         new Uri("https://www.sandbox.paypal.com/signin/authorize", UriKind.Absolute);

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs

@@ -1065,8 +1065,8 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                          context.UserinfoResponse?.HasParameter("lastName")  is true
                     => $"{(string?) context.UserinfoResponse?["firstName"]} {(string?) context.UserinfoResponse?["lastName"]}",
 
-                // Spotify and StackExchange return the username as a custom "display_name" node:
-                ProviderTypes.Spotify or ProviderTypes.StackExchange
+                // These providers return return the username as a custom "display_name" node:
+                ProviderTypes.Spotify or ProviderTypes.StackExchange or ProviderTypes.Zoom
                     => (string?) context.UserinfoResponse?["display_name"],
 
                 // Strava returns the username as a custom "athlete/username" node in token responses:
@@ -1095,7 +1095,8 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                 ProviderTypes.Facebook or ProviderTypes.GitHub        or ProviderTypes.Harvest    or
                 ProviderTypes.Kroger   or ProviderTypes.Lichess       or ProviderTypes.Nextcloud  or
                 ProviderTypes.Patreon  or ProviderTypes.Reddit        or ProviderTypes.Smartsheet or
-                ProviderTypes.Spotify  or ProviderTypes.SubscribeStar or ProviderTypes.Twitter
+                ProviderTypes.Spotify  or ProviderTypes.SubscribeStar or ProviderTypes.Twitter    or
+                ProviderTypes.Zoom
                     => (string?) context.UserinfoResponse?["id"],
 
                 // Bitbucket returns the user identifier as a custom "uuid" node:

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml

@@ -1431,4 +1431,29 @@
     <Environment Issuer="https://api.login.yahoo.com/" />
   </Provider>
 
+  <!--
+                                              ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
+                                              ██ ▄▄▄ ██ ▄▄▄ ██ ▄▄▄ ██ ▄▀▄ ██
+                                              ██▀▀▀▄▄██ ███ ██ ███ ██ █ █ ██
+                                              ██ ▀▀▀ ██ ▀▀▀ ██ ▀▀▀ ██ ███ ██
+                                              ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
+  -->
+
+  <Provider Name="Zoom" Id="2aa63549-8bb3-426d-a95d-dbc2479167e6"
+            Documentation="https://developers.zoom.us/docs/integrations/oauth/">
+    <Environment Issuer="https://zoom.us/">
+      <Configuration AuthorizationEndpoint="https://zoom.us/oauth/authorize"
+                     TokenEndpoint="https://zoom.us/oauth/token"
+                     UserinfoEndpoint="https://api.zoom.us/v2/users/me">
+        <CodeChallengeMethod Value="plain" />
+        <CodeChallengeMethod Value="S256" />
+
+        <GrantType Value="authorization_code" />
+        <GrantType Value="refresh_token" />
+
+        <TokenEndpointAuthMethod Value="client_secret_basic" />
+      </Configuration>
+    </Environment>
+  </Provider>
+
 </Providers>

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictEntityFrameworkCoreAuthorizationStore.cs

@@ -234,7 +234,7 @@ public class OpenIddictEntityFrameworkCoreAuthorizationStore<TAuthorization, TAp
 
         // Note: due to a bug in Entity Framework Core's query visitor, the authorizations can't be
         // filtered using authorization.Application.Id.Equals(key). To work around this issue,
-        // this method is overriden to use an explicit join before applying the equality check.
+        // this method is overridden to use an explicit join before applying the equality check.
         // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
 
         var key = ConvertIdentifierFromString(client);
@@ -268,7 +268,7 @@ public class OpenIddictEntityFrameworkCoreAuthorizationStore<TAuthorization, TAp
 
         // Note: due to a bug in Entity Framework Core's query visitor, the authorizations can't be
         // filtered using authorization.Application.Id.Equals(key). To work around this issue,
-        // this method is overriden to use an explicit join before applying the equality check.
+        // this method is overridden to use an explicit join before applying the equality check.
         // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
 
         var key = ConvertIdentifierFromString(client);
@@ -307,7 +307,7 @@ public class OpenIddictEntityFrameworkCoreAuthorizationStore<TAuthorization, TAp
 
         // Note: due to a bug in Entity Framework Core's query visitor, the authorizations can't be
         // filtered using authorization.Application.Id.Equals(key). To work around this issue,
-        // this method is overriden to use an explicit join before applying the equality check.
+        // this method is overridden to use an explicit join before applying the equality check.
         // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
 
         var key = ConvertIdentifierFromString(client);
@@ -353,7 +353,7 @@ public class OpenIddictEntityFrameworkCoreAuthorizationStore<TAuthorization, TAp
         {
             // Note: due to a bug in Entity Framework Core's query visitor, the authorizations can't be
             // filtered using authorization.Application.Id.Equals(key). To work around this issue,
-            // this method is overriden to use an explicit join before applying the equality check.
+            // this method is overridden to use an explicit join before applying the equality check.
             // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
 
             var key = ConvertIdentifierFromString(client);
@@ -389,7 +389,7 @@ public class OpenIddictEntityFrameworkCoreAuthorizationStore<TAuthorization, TAp
 
         // Note: due to a bug in Entity Framework Core's query visitor, the authorizations can't be
         // filtered using authorization.Application.Id.Equals(key). To work around this issue,
-        // this method is overriden to use an explicit join before applying the equality check.
+        // this method is overridden to use an explicit join before applying the equality check.
         // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
 
         var key = ConvertIdentifierFromString(identifier);

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictEntityFrameworkCoreTokenStore.cs

@@ -278,7 +278,7 @@ public class OpenIddictEntityFrameworkCoreTokenStore<TToken, TApplication, TAuth
 
         // Note: due to a bug in Entity Framework Core's query visitor, the tokens can't be
         // filtered using token.Application.Id.Equals(key). To work around this issue,
-        // this method is overriden to use an explicit join before applying the equality check.
+        // this method is overridden to use an explicit join before applying the equality check.
         // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
 
         var key = ConvertIdentifierFromString(identifier);
@@ -299,7 +299,7 @@ public class OpenIddictEntityFrameworkCoreTokenStore<TToken, TApplication, TAuth
 
         // Note: due to a bug in Entity Framework Core's query visitor, the tokens can't be
         // filtered using token.Authorization.Id.Equals(key). To work around this issue,
-        // this method is overriden to use an explicit join before applying the equality check.
+        // this method is overridden to use an explicit join before applying the equality check.
         // See https://github.com/openiddict/openiddict-core/issues/499 for more information.
 
         var key = ConvertIdentifierFromString(identifier);

src/OpenIddict.Server.DataProtection/OpenIddictServerDataProtectionHandlers.Protection.cs

@@ -283,7 +283,7 @@ public static partial class OpenIddictServerDataProtectionHandlers
                 // of the default token format (typically, JSON Web Token). By default, Data Protection
                 // is automatically used for all the supported token types once the integration is enabled
                 // but the default token format can be re-enabled in the options. Alternatively, the token
-                // format can be overriden manually using a custom event handler registered after this one.
+                // format can be overridden manually using a custom event handler registered after this one.
 
                 context.TokenFormat = context.TokenType switch
                 {

test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.cs

@@ -2132,7 +2132,7 @@ public abstract partial class OpenIddictServerIntegrationTests
     }
 
     [Fact]
-    public async Task ProcessSignIn_ScopesCanBeOverridenForRefreshTokenRequests()
+    public async Task ProcessSignIn_ScopesCanBeOverriddenForRefreshTokenRequests()
     {
         // Arrange
         await using var server = await CreateServerAsync(options =>