Add Twitter support and remove scope constants generation

gen/OpenIddict.Client.WebIntegration.Generators/OpenIddictClientWebIntegrationGenerator.cs

@@ -44,10 +44,6 @@ namespace OpenIddict.Client.WebIntegration.Generators
                 "OpenIddictClientWebIntegrationHelpers.generated.cs",
                 SourceText.From(GenerateHelpers(document), Encoding.UTF8));
 
-            context.AddSource(
-                "OpenIddictClientWebIntegrationScopes.generated.cs",
-                SourceText.From(GenerateScopes(document), Encoding.UTF8));
-
             context.AddSource(
                 "OpenIddictClientWebIntegrationSettings.generated.cs",
                 SourceText.From(GenerateSettings(document), Encoding.UTF8));
@@ -230,7 +226,7 @@ public partial class OpenIddictClientWebIntegrationConfiguration
 
                 {{~ for setting in provider.settings ~}}
                 {{~ if setting.required ~}}
-                {{~ if setting.type == 'string' ~}} 
+                {{~ if setting.type == 'String' ~}} 
                 if (string.IsNullOrEmpty(settings.{{ setting.name }}))
                 {{~ else ~}}
                 if (settings.{{ setting.name }} is null)
@@ -333,7 +329,7 @@ public partial class OpenIddictClientWebIntegrationConfiguration
                     EncryptionCredentials =
                     {
                         {{~ for setting in provider.settings ~}}
-                        {{~ if setting.encryption_algorithm ~}}
+                        {{~ if setting.type == 'EncryptionKey' ~}}
                         new EncryptingCredentials(settings.{{ setting.name }}, ""{{ setting.encryption_algorithm }}"", SecurityAlgorithms.Aes256CbcHmacSha512),
                         {{~ end ~}}
                         {{~ end ~}}
@@ -342,7 +338,7 @@ public partial class OpenIddictClientWebIntegrationConfiguration
                     SigningCredentials =
                     {
                         {{~ for setting in provider.settings ~}}
-                        {{~ if setting.signing_algorithm ~}}
+                        {{~ if setting.type == 'SigningKey' ~}}
                         new SigningCredentials(settings.{{ setting.name }}, ""{{ setting.signing_algorithm }}""),
                         {{~ end ~}}
                         {{~ end ~}}
@@ -375,6 +371,21 @@ public partial class OpenIddictClientWebIntegrationConfiguration
                 }
                 {{~ end ~}}
 
+                {{~ for setting in provider.settings ~}}
+                {{~ for item in setting.collection_items ~}}
+                {{~ if item.required ~}}
+                settings.{{ setting.name }}.Add(""{{ item.value }}"");
+                {{~ end ~}}
+
+                {{~ if item.default ~}}
+                if (settings.{{ setting.name }}.Count is 0)
+                {
+                    settings.{{ setting.name }}.Add(""{{ item.value }}"");
+                }
+                {{~ end ~}}
+                {{~ end ~}}
+                {{~ end ~}}
+
                 options.Registrations.Add(registration);
             }
         }
@@ -466,8 +477,17 @@ public partial class OpenIddictClientWebIntegrationConfiguration
                                 Name = (string) setting.Attribute("Name"),
                                 Type = (string) setting.Attribute("Type"),
                                 Required = (bool?) setting.Attribute("Required") ?? false,
-                                EncryptionAlgorithm = (string?) setting.Attribute("EncryptionAlgorithm"),
-                                SigningAlgorithm = (string?) setting.Attribute("SigningAlgorithm")
+
+                                EncryptionAlgorithm = (string?) setting.Element("EncryptionAlgorithm")?.Attribute("Value"),
+                                SigningAlgorithm = (string?) setting.Element("SigningAlgorithm")?.Attribute("Value"),
+
+                                CollectionItems = setting.Elements("CollectionItem").Select(item => new
+                                {
+                                    Value = (string) item.Attribute("Value"),
+                                    Default = (bool?) item.Attribute("Default") ?? false,
+                                    Required = (bool?) item.Attribute("Required") ?? false
+                                })
+                                .ToList()
                             })
                             .ToList()
                         })
@@ -512,55 +532,6 @@ public partial class OpenIddictClientWebIntegrationHelpers
                 });
             }
 
-            static string GenerateScopes(XDocument document)
-            {
-                var template = Template.Parse(@"#nullable enable
-
-namespace OpenIddict.Client.WebIntegration;
-
-public static partial class OpenIddictClientWebIntegrationScopes
-{
-    {{~ for provider in providers ~}}
-    /// <summary>
-    /// Exposes the scopes supported by the {{ provider.name }} provider.
-    /// </summary>
-    public static class {{ provider.name }}
-    {
-        {{~ for scope in provider.scopes ~}}
-        {{~ if scope.description ~}}
-        /// <summary>
-        /// {{ scope.description }}
-        /// </summary>
-        {{~ end ~}}
-        public const string {{ scope.clr_name }} = ""{{ scope.name }}"";
-        {{~ end ~}}
-    }
-    {{~ end ~}}
-}
-");
-                return template.Render(new
-                {
-                    Providers = document.Root.Elements("Provider")
-                        .Select(provider => new
-                        {
-                            Name = (string) provider.Attribute("Name"),
-
-                            Scopes = provider.Elements("Environment")
-                                .SelectMany(environment => environment.Elements("Scope"))
-                                .Select(scope => new
-                                {
-                                    Name = (string) scope.Attribute("Name"),
-                                    ClrName = Regex.Replace((string) scope.Attribute("Name"), "(?:^|_| +)(.)",
-                                        match => match.Groups[1].Value.ToUpper(CultureInfo.InvariantCulture)),
-                                    Description = (string?) scope.Attribute("Description")
-                                })
-                                .Distinct(scope => scope.ClrName)
-                                .ToList()
-                        })
-                        .ToList()
-                });
-            }
-
             static string GenerateSettings(XDocument document)
             {
                 var template = Template.Parse(@"#nullable enable
@@ -583,8 +554,12 @@ public partial class OpenIddictClientWebIntegrationSettings
         /// {{ setting.description }}
         /// </summary>
         {{~ end ~}}
+        {{~ if setting.collection ~}}
+        public HashSet<{{ setting.type }}> {{ setting.name }} { get; } = new();
+        {{~ else ~}}
         public {{ setting.type }}? {{ setting.name }} { get; set; }
         {{~ end ~}}
+        {{~ end ~}}
 
         /// <summary>
         /// Gets or sets the environment that determines the endpoints to use.
@@ -603,9 +578,26 @@ public partial class OpenIddictClientWebIntegrationSettings
 
                             Settings = provider.Elements("Setting").Select(setting => new
                             {
-                                Type = (string) setting.Attribute("Type"),
                                 Name = (string) setting.Attribute("Name"),
-                                Description = (string) setting.Attribute("Description")
+                                Collection = (bool?) setting.Attribute("Collection") ?? false,
+                                Description = (string) setting.Attribute("Description"),
+                                Type = (string) setting.Attribute("Type") switch
+                                {
+                                    "EncryptionKey" when (string) setting.Element("EncryptionAlgorithm").Attribute("Value")
+                                        is "RS256" or "RS384" or "RS512" => "RsaSecurityKey",
+
+                                    "SigningKey" when (string) setting.Element("SigningAlgorithm").Attribute("Value")
+                                        is "ES256" or "ES384" or "ES512" => "ECDsaSecurityKey",
+
+                                    "SigningKey" when (string) setting.Element("SigningAlgorithm").Attribute("Value")
+                                        is "PS256" or "PS384" or "PS512" or
+                                           "RS256" or "RS384" or "RS512" => "RsaSecurityKey",
+
+                                    "String" => "string",
+                                    "StringHashSet" => "HashSet<string>",
+
+                                    string value => value
+                                }
                             })
                             .ToList()
                         })

sandbox/OpenIddict.Sandbox.AspNet.Client/Controllers/AuthenticationController.cs

@@ -25,6 +25,7 @@ namespace OpenIddict.Sandbox.AspNet.Client.Controllers
                 "local" or "local-github" => "https://localhost:44349/",
                 "github"                  => "https://github.com/",
                 "google"                  => "https://accounts.google.com/",
+                "twitter"                 => "https://twitter.com/",
 
                 _ => null
             };
@@ -121,7 +122,7 @@ namespace OpenIddict.Sandbox.AspNet.Client.Controllers
                         => new Claim(ClaimTypes.Name, claim.Value, claim.ValueType, claim.Issuer),
 
                     // Applications can map non-standard claims issued by specific issuers to a standard equivalent.
-                    { Type: "id", Issuer: "https://github.com/" }
+                    { Type: "id", Issuer: "https://github.com/" or "https://twitter.com/" }
                         => new Claim(Claims.Subject, claim.Value, claim.ValueType, claim.Issuer),
 
                     _ => claim

sandbox/OpenIddict.Sandbox.AspNet.Client/Startup.cs

@@ -75,7 +75,8 @@ namespace OpenIddict.Sandbox.AspNet.Client
                     options.SetRedirectionEndpointUris(
                         "/signin-local",
                         "/signin-github",
-                        "/signin-google");
+                        "/signin-google",
+                        "/signin-twitter");
 
                     // Register the signing and encryption credentials used to protect
                     // sensitive data like the state tokens produced by OpenIddict.
@@ -114,6 +115,12 @@ namespace OpenIddict.Sandbox.AspNet.Client
                                ClientSecret = "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",
                                RedirectUri = new Uri("https://localhost:44378/signin-google", UriKind.Absolute),
                                Scopes = { Scopes.Profile }
+                           })
+                           .AddTwitter(new()
+                           {
+                               ClientId = "bXgwc0U3N3A3YWNuaWVsdlRmRWE6MTpjaQ",
+                               ClientSecret = "VcohOgBp-6yQCurngo4GAyKeZh0D6SUCCSjJgEo1uRzJarjIUS",
+                               RedirectUri = new Uri("https://localhost:44378/signin-twitter", UriKind.Absolute)
                            });
                 });
 

sandbox/OpenIddict.Sandbox.AspNet.Client/Views/Home/Index.cshtml

@@ -43,5 +43,7 @@
             new { provider = "github" }, new { @class = "btn btn-lg btn-success" })
         @Html.ActionLink("Sign in using Google", "Login", "Authentication",
             new { provider = "google" }, new { @class = "btn btn-lg btn-success" })
+        @Html.ActionLink("Sign in using Twitter", "Login", "Authentication",
+            new { provider = "twitter" }, new { @class = "btn btn-lg btn-success" })
     }
 </div>

sandbox/OpenIddict.Sandbox.AspNetCore.Client/Controllers/AuthenticationController.cs

@@ -18,6 +18,7 @@ public class AuthenticationController : Controller
             "github"                  => "https://github.com/",
             "google"                  => "https://accounts.google.com/",
             "reddit"                  => "https://www.reddit.com/",
+            "twitter"                 => "https://twitter.com/",
 
             _ => null
         };
@@ -100,7 +101,7 @@ public class AuthenticationController : Controller
             .Select(claim => claim switch
             {
                 // Applications can map non-standard claims issued by specific issuers to a standard equivalent.
-                { Type: "id", Issuer: "https://github.com/" }
+                { Type: "id", Issuer: "https://github.com/" or "https://twitter.com/" }
                     => new Claim(Claims.Subject, claim.Value, claim.ValueType, claim.Issuer),
 
                 _ => claim

sandbox/OpenIddict.Sandbox.AspNetCore.Client/Startup.cs

@@ -84,7 +84,8 @@ public class Startup
                     "/signin-local",
                     "/signin-github",
                     "/signin-google",
-                    "/signin-reddit");
+                    "/signin-reddit",
+                    "/signin-twitter");
 
                 // Register the signing and encryption credentials used to protect
                 // sensitive data like the state tokens produced by OpenIddict.
@@ -132,6 +133,12 @@ public class Startup
                            RedirectUri = new Uri("https://localhost:44381/signin-reddit", UriKind.Absolute),
                            ProductName = "DemoApp",
                            ProductVersion = "1.0.0"
+                       })
+                       .AddTwitter(new()
+                       {
+                           ClientId = "bXgwc0U3N3A3YWNuaWVsdlRmRWE6MTpjaQ",
+                           ClientSecret = "VcohOgBp-6yQCurngo4GAyKeZh0D6SUCCSjJgEo1uRzJarjIUS",
+                           RedirectUri = new Uri("https://localhost:44381/signin-twitter", UriKind.Absolute)
                        });
             });
 

sandbox/OpenIddict.Sandbox.AspNetCore.Client/Views/Home/Index.cshtml

@@ -41,5 +41,7 @@
             asp-action="Login" asp-route-provider="google">Sign in using Google</a>
         <a class="btn btn-lg btn-success" asp-controller="Authentication"
             asp-action="Login" asp-route-provider="reddit">Sign in using Reddit</a>
+        <a class="btn btn-lg btn-success" asp-controller="Authentication"
+            asp-action="Login" asp-route-provider="twitter">Sign in using Twitter</a>
     }
 </div>

src/OpenIddict.Abstractions/OpenIddictResources.resx

@@ -1298,6 +1298,9 @@ Alternatively, you can disable the token storage feature by calling 'services.Ad
   <data name="ID0333" xml:space="preserve">
     <value>The '{0}' provider settings cannot be resolved from the event context. Make sure the provider was correctly registered using 'services.AddOpenIddict().AddClient().UseWebProviders().Add{0}()'.</value>
   </data>
+  <data name="ID0334" xml:space="preserve">
+    <value>The '{0}' node cannot be extracted from the response.</value>
+  </data>
   <data name="ID2000" xml:space="preserve">
     <value>The security token is missing.</value>
   </data>

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Userinfo.cs

@@ -5,6 +5,9 @@
  */
 
 using System.Collections.Immutable;
+using System.Diagnostics;
+using static OpenIddict.Client.SystemNetHttp.OpenIddictClientSystemNetHttpHandlers;
+using static OpenIddict.Client.WebIntegration.OpenIddictClientWebIntegrationConstants;
 
 namespace OpenIddict.Client.WebIntegration;
 
@@ -16,6 +19,96 @@ public static partial class OpenIddictClientWebIntegrationHandlers
             /*
              * Userinfo request preparation:
              */
-            UseProductNameAsUserAgent<PrepareUserinfoRequestContext>.Descriptor);
+            UseProductNameAsUserAgent<PrepareUserinfoRequestContext>.Descriptor,
+            AttachNonStandardFieldParameter.Descriptor,
+
+            /*
+             * Userinfo response extraction:
+             */
+            UnwrapUserinfoResponse.Descriptor);
+
+        /// <summary>
+        /// Contains the logic responsible for attaching non-standard field parameters for the providers that require it.
+        /// </summary>
+        public class AttachNonStandardFieldParameter : IOpenIddictClientHandler<PrepareUserinfoRequestContext>
+        {
+            /// <summary>
+            /// Gets the default descriptor definition assigned to this handler.
+            /// </summary>
+            public static OpenIddictClientHandlerDescriptor Descriptor { get; }
+                = OpenIddictClientHandlerDescriptor.CreateBuilder<PrepareUserinfoRequestContext>()
+                    .UseSingletonHandler<AttachNonStandardFieldParameter>()
+                    .SetOrder(PrepareGetHttpRequest<PrepareUserinfoRequestContext>.Descriptor.Order - 500)
+                    .SetType(OpenIddictClientHandlerType.BuiltIn)
+                    .Build();
+
+            /// <inheritdoc/>
+            public ValueTask HandleAsync(PrepareUserinfoRequestContext context)
+            {
+                if (context is null)
+                {
+                    throw new ArgumentNullException(nameof(context));
+                }
+
+                Debug.Assert(context.Request is not null, SR.GetResourceString(SR.ID4008));
+
+                // Some providers are known to limit the number of fields returned by their userinfo endpoint
+                // but allow returning additional information using a special parameter (generally called "fields")
+                // that determines what fields will be returned as part of the userinfo response. This handler is
+                // responsible for resolving the fields from the provider settings and attaching them to the request.
+
+                if (context.Registration.GetProviderName() is Providers.Twitter)
+                {
+                    var settings = context.Registration.GetTwitterSettings();
+
+                    context.Request["expansions"] = string.Join(",", settings.Expansions);
+                    context.Request["tweet.fields"] = string.Join(",", settings.TweetFields);
+                    context.Request["user.fields"] = string.Join(",", settings.UserFields);
+                }
+
+                return default;
+            }
+        }
+
+        /// <summary>
+        /// Contains the logic responsible for extracting the userinfo response
+        /// from nested JSON nodes (e.g "data") for the providers that require it.
+        /// </summary>
+        public class UnwrapUserinfoResponse : IOpenIddictClientHandler<ExtractUserinfoResponseContext>
+        {
+            /// <summary>
+            /// Gets the default descriptor definition assigned to this handler.
+            /// </summary>
+            public static OpenIddictClientHandlerDescriptor Descriptor { get; }
+                = OpenIddictClientHandlerDescriptor.CreateBuilder<ExtractUserinfoResponseContext>()
+                    .UseSingletonHandler<UnwrapUserinfoResponse>()
+                    .SetOrder(ExtractJsonHttpResponse<ExtractUserinfoResponseContext>.Descriptor.Order + 500)
+                    .SetType(OpenIddictClientHandlerType.BuiltIn)
+                    .Build();
+
+            /// <inheritdoc/>
+            public ValueTask HandleAsync(ExtractUserinfoResponseContext context)
+            {
+                if (context is null)
+                {
+                    throw new ArgumentNullException(nameof(context));
+                }
+
+                Debug.Assert(context.Response is not null, SR.GetResourceString(SR.ID4007));
+
+                // Some providers are known to wrap their userinfo payloads in top-level JSON nodes
+                // (generally named "d", "data" or "content"), which prevents the default extraction
+                // logic from mapping the parameters to CLR claims. To work around that, this handler
+                // is responsible for extracting the nested payload and replacing the userinfo response.
+
+                if (context.Registration.GetProviderName() is Providers.Twitter)
+                {
+                    context.Response = new OpenIddictResponse(context.Response["data"]?.GetNamedParameters() ??
+                        throw new InvalidOperationException(SR.FormatID0334("data")));
+                }
+
+                return default;
+            }
+        }
     }
 }

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml

@@ -4,10 +4,12 @@
   <Provider Name="Apple" Documentation="https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api">
     <Environment Issuer="https://appleid.apple.com/" />
 
-    <Setting Name="SigningKey" Type="ECDsaSecurityKey" Required="true" SigningAlgorithm="ES256"
-             Description="Gets or sets the ECDSA signing key associated with the developer account." />
+    <Setting Name="SigningKey" Type="SigningKey" Required="true"
+             Description="Gets or sets the ECDSA signing key associated with the developer account.">
+      <SigningAlgorithm Value="ES256" />
+    </Setting>
 
-    <Setting Name="TeamId" Type="string" Required="true"
+    <Setting Name="TeamId" Type="String" Required="true"
              Description="Gets or sets the Team ID associated with the developer account." />
   </Provider>
 
@@ -38,14 +40,46 @@
         is always added even if another scope was explicitly registered by the user.
       -->
 
-      <Scope Name="identity" Required="true" Description="Access my reddit username and signup date." />
+      <Scope Name="identity" Default="true" Required="true" />
     </Environment>
 
-    <Setting Name="ProductName" Type="string" Required="false"
+    <Setting Name="ProductName" Type="String" Required="false"
              Description="Gets or sets the product name used in the user agent header." />
 
-    <Setting Name="ProductVersion" Type="string" Required="false"
+    <Setting Name="ProductVersion" Type="String" Required="false"
              Description="Gets or sets the product version used in the user agent header." />
   </Provider>
 
+  <Provider Name="Twitter" Documentation="https://developer.twitter.com/en/docs/authentication/oauth-2-0/authorization-code">
+    <Environment Issuer="https://twitter.com/">
+      <Configuration AuthorizationEndpoint="https://twitter.com/i/oauth2/authorize"
+                     TokenEndpoint="https://api.twitter.com/2/oauth2/token"
+                     UserinfoEndpoint="https://api.twitter.com/2/users/me">
+        <CodeChallengeMethod Value="S256" />
+
+        <TokenEndpointAuthMethod Value="client_secret_basic" />
+      </Configuration>
+
+      <!--
+        Note: Twitter requires requesting the "tweet.read" and "users.read" scopes for the
+        userinfo endpoint to work correctly. As such, these 2 scopes are marked as required
+        so they are always sent even if they were not explicitly added by the user.
+      -->
+
+      <Scope Name="tweet.read" Default="true" Required="true" />
+      <Scope Name="users.read" Default="true" Required="true" />
+    </Environment>
+
+    <Setting Name="Expansions" Collection="true" Type="String"
+             Description="Gets the list of data objects to expand from the userinfo endpoint." />
+
+    <Setting Name="TweetFields" Collection="true" Type="String"
+             Description="Gets the tweet fields that should be retrieved from the userinfo endpoint." />
+
+    <Setting Name="UserFields" Collection="true" Type="String"
+             Description="Gets the user fields that should be retrieved from the userinfo endpoint.">
+      <CollectionItem Value="profile_image_url" Default="true" Required="false" />
+    </Setting>
+  </Provider>
+
 </Providers>

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xsd

@@ -191,7 +191,7 @@
                           </xs:simpleType>
                         </xs:attribute>
 
-                        <xs:attribute name="Default" use="optional">
+                        <xs:attribute name="Default" use="required">
                           <xs:annotation>
                             <xs:documentation>A boolean indicating whether the scope is automatically added if no other scope is added by the user.</xs:documentation>
                           </xs:annotation>
@@ -201,7 +201,7 @@
                           </xs:simpleType>
                         </xs:attribute>
 
-                        <xs:attribute name="Required" use="optional">
+                        <xs:attribute name="Required" use="required">
                           <xs:annotation>
                             <xs:documentation>A boolean indicating whether the scope is always added even if another scope is already added by the user.</xs:documentation>
                           </xs:annotation>
@@ -210,12 +210,6 @@
                             <xs:restriction base="xs:boolean" />
                           </xs:simpleType>
                         </xs:attribute>
-
-                        <xs:attribute name="Description" type="xs:string" use="required">
-                          <xs:annotation>
-                            <xs:documentation>The scope description.</xs:documentation>
-                          </xs:annotation>
-                        </xs:attribute>
                       </xs:complexType>
                     </xs:element>
                   </xs:sequence>
@@ -246,6 +240,95 @@
                 </xs:annotation>
 
                 <xs:complexType>
+                  <xs:sequence>
+                    <xs:element name="CollectionItem" minOccurs="0" maxOccurs="1">
+                      <xs:annotation>
+                        <xs:documentation>An item added by default to the collection, if applicable.</xs:documentation>
+                      </xs:annotation>
+
+                      <xs:complexType>
+                        <xs:attribute name="Value" use="required">
+                          <xs:annotation>
+                            <xs:documentation>The value of the item.</xs:documentation>
+                          </xs:annotation>
+
+                          <xs:simpleType>
+                            <xs:restriction base="xs:string" />
+                          </xs:simpleType>
+                        </xs:attribute>
+
+                        <xs:attribute name="Default" use="required">
+                          <xs:annotation>
+                            <xs:documentation>A boolean indicating whether the item is automatically added if no other item is added by the user.</xs:documentation>
+                          </xs:annotation>
+
+                          <xs:simpleType>
+                            <xs:restriction base="xs:boolean" />
+                          </xs:simpleType>
+                        </xs:attribute>
+
+                        <xs:attribute name="Required" use="required">
+                          <xs:annotation>
+                            <xs:documentation>A boolean indicating whether the item is always added even if another item is already added by the user.</xs:documentation>
+                          </xs:annotation>
+
+                          <xs:simpleType>
+                            <xs:restriction base="xs:boolean" />
+                          </xs:simpleType>
+                        </xs:attribute>
+                      </xs:complexType>
+                    </xs:element>
+
+                    <xs:element name="EncryptionAlgorithm" minOccurs="0" maxOccurs="1">
+                      <xs:annotation>
+                        <xs:documentation>The encryption algorithm used with the encryption key, if applicable.</xs:documentation>
+                      </xs:annotation>
+
+                      <xs:complexType>
+                        <xs:attribute name="Value" use="required">
+                          <xs:annotation>
+                            <xs:documentation>The encryption algorithm name (e.g RSA-OAEP).</xs:documentation>
+                          </xs:annotation>
+
+                          <xs:simpleType>
+                            <xs:restriction base="xs:string">
+                              <xs:enumeration value="A256KW" />
+                              <xs:enumeration value="RSA-OAEP" />
+                            </xs:restriction>
+                          </xs:simpleType>
+                        </xs:attribute>
+                      </xs:complexType>
+                    </xs:element>
+
+                    <xs:element name="SigningAlgorithm" minOccurs="0" maxOccurs="1">
+                      <xs:annotation>
+                        <xs:documentation>The signing algorithm used with the signing key, if applicable.</xs:documentation>
+                      </xs:annotation>
+
+                      <xs:complexType>
+                        <xs:attribute name="Value" use="required">
+                          <xs:annotation>
+                            <xs:documentation>The signing algorithm name (e.g RS256).</xs:documentation>
+                          </xs:annotation>
+
+                          <xs:simpleType>
+                            <xs:restriction base="xs:string">
+                              <xs:enumeration value="ES256" />
+                              <xs:enumeration value="ES384" />
+                              <xs:enumeration value="ES512" />
+                              <xs:enumeration value="PS256" />
+                              <xs:enumeration value="PS384" />
+                              <xs:enumeration value="PS512" />
+                              <xs:enumeration value="RS256" />
+                              <xs:enumeration value="RS384" />
+                              <xs:enumeration value="RS512" />
+                            </xs:restriction>
+                          </xs:simpleType>
+                        </xs:attribute>
+                      </xs:complexType>
+                    </xs:element>
+                  </xs:sequence>
+
                   <xs:attribute name="Name" use="required">
                     <xs:annotation>
                       <xs:documentation>The setting name.</xs:documentation>
@@ -258,22 +341,9 @@
                     </xs:simpleType>
                   </xs:attribute>
 
-                  <xs:attribute name="Type" use="required">
-                    <xs:annotation>
-                      <xs:documentation>The setting type.</xs:documentation>
-                    </xs:annotation>
-
-                    <xs:simpleType>
-                      <xs:restriction base="xs:string">
-                        <xs:enumeration value="ECDsaSecurityKey" />
-                        <xs:enumeration value="string" />
-                      </xs:restriction>
-                    </xs:simpleType>
-                  </xs:attribute>
-
-                  <xs:attribute name="Required" use="required">
+                  <xs:attribute name="Collection" use="optional">
                     <xs:annotation>
-                      <xs:documentation>A boolean indicating whether the setting is required.</xs:documentation>
+                      <xs:documentation>A boolean indicating whether the setting is a collection.</xs:documentation>
                     </xs:annotation>
 
                     <xs:simpleType>
@@ -281,36 +351,27 @@
                     </xs:simpleType>
                   </xs:attribute>
 
-                  <xs:attribute name="EncryptionAlgorithm" use="optional">
+                  <xs:attribute name="Type" use="required">
                     <xs:annotation>
-                      <xs:documentation>The encryption algorithm, if applicable.</xs:documentation>
+                      <xs:documentation>The setting type.</xs:documentation>
                     </xs:annotation>
 
                     <xs:simpleType>
                       <xs:restriction base="xs:string">
-                        <xs:enumeration value="A256KW" />
-                        <xs:enumeration value="RSA-OAEP" />
+                        <xs:enumeration value="EncryptionKey" />
+                        <xs:enumeration value="SigningKey" />
+                        <xs:enumeration value="String" />
                       </xs:restriction>
                     </xs:simpleType>
                   </xs:attribute>
 
-                  <xs:attribute name="SigningAlgorithm" use="optional">
+                  <xs:attribute name="Required" use="optional">
                     <xs:annotation>
-                      <xs:documentation>The signing algorithm, if applicable.</xs:documentation>
+                      <xs:documentation>A boolean indicating whether the setting is required.</xs:documentation>
                     </xs:annotation>
 
                     <xs:simpleType>
-                      <xs:restriction base="xs:string">
-                        <xs:enumeration value="ES256" />
-                        <xs:enumeration value="ES384" />
-                        <xs:enumeration value="ES512" />
-                        <xs:enumeration value="PS256" />
-                        <xs:enumeration value="PS384" />
-                        <xs:enumeration value="PS512" />
-                        <xs:enumeration value="RS256" />
-                        <xs:enumeration value="RS384" />
-                        <xs:enumeration value="RS512" />
-                      </xs:restriction>
+                      <xs:restriction base="xs:boolean" />
                     </xs:simpleType>
                   </xs:attribute>
 

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationScopes.cs

@@ -1,15 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
- * See https://github.com/openiddict/openiddict-core for more information concerning
- * the license and the contributors participating to this project.
- */
-
-namespace OpenIddict.Client.WebIntegration;
-
-/// <summary>
-/// Exposes the provider-specific scopes supported by the OpenIddict client Web integration services.
-/// </summary>
-public static partial class OpenIddictClientWebIntegrationScopes
-{
-    // Note: scopes are automatically generated by the source generator.
-}