Incorporate the changes committed in the rel/3.0.3 branch

src/OpenIddict.EntityFramework/Stores/OpenIddictEntityFrameworkAuthorizationStore.cs

@@ -633,9 +633,15 @@ namespace OpenIddict.EntityFramework
                 // and thus prevent them from being concurrently modified outside this block.
                 using var transaction = CreateTransaction();
 
+                // Note: the Oracle MySQL provider doesn't support DateTimeOffset and is unable
+                // to create a SQL query with an expression calling DateTimeOffset.UtcDateTime.
+                // To work around this limitation, the threshold represented as a DateTimeOffset
+                // instance is manually converted to a UTC DateTime instance outside the query.
+                var date = threshold.UtcDateTime;
+
                 var authorizations =
                     await (from authorization in Authorizations.Include(authorization => authorization.Tokens)
-                           where authorization.CreationDate < threshold.UtcDateTime
+                           where authorization.CreationDate < date
                            where authorization.Status != Statuses.Valid ||
                                 (authorization.Type == AuthorizationTypes.AdHoc && !authorization.Tokens.Any())
                            orderby authorization.Id

src/OpenIddict.EntityFramework/Stores/OpenIddictEntityFrameworkTokenStore.cs

@@ -618,9 +618,15 @@ namespace OpenIddict.EntityFramework
                 // and thus prevent them from being concurrently modified outside this block.
                 using var transaction = CreateTransaction();
 
+                // Note: the Oracle MySQL provider doesn't support DateTimeOffset and is unable
+                // to create a SQL query with an expression calling DateTimeOffset.UtcDateTime.
+                // To work around this limitation, the threshold represented as a DateTimeOffset
+                // instance is manually converted to a UTC DateTime instance outside the query.
+                var date = threshold.UtcDateTime;
+
                 var tokens = await
                     (from token in Tokens
-                     where token.CreationDate < threshold.UtcDateTime
+                     where token.CreationDate < date
                      where (token.Status != Statuses.Inactive && token.Status != Statuses.Valid) ||
                            (token.Authorization != null && token.Authorization.Status != Statuses.Valid) ||
                             token.ExpirationDate < DateTime.UtcNow

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictEntityFrameworkCoreAuthorizationStore.cs

@@ -713,9 +713,15 @@ namespace OpenIddict.EntityFrameworkCore
                 // and thus prevent them from being concurrently modified outside this block.
                 using var transaction = await CreateTransactionAsync();
 
+                // Note: the Oracle MySQL provider doesn't support DateTimeOffset and is unable
+                // to create a SQL query with an expression calling DateTimeOffset.UtcDateTime.
+                // To work around this limitation, the threshold represented as a DateTimeOffset
+                // instance is manually converted to a UTC DateTime instance outside the query.
+                var date = threshold.UtcDateTime;
+
                 var authorizations =
                     await (from authorization in Authorizations.Include(authorization => authorization.Tokens).AsTracking()
-                           where authorization.CreationDate < threshold.UtcDateTime
+                           where authorization.CreationDate < date
                            where authorization.Status != Statuses.Valid ||
                                 (authorization.Type == AuthorizationTypes.AdHoc && !authorization.Tokens.Any())
                            orderby authorization.Id

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictEntityFrameworkCoreTokenStore.cs

@@ -681,9 +681,15 @@ namespace OpenIddict.EntityFrameworkCore
                 // and thus prevent them from being concurrently modified outside this block.
                 using var transaction = await CreateTransactionAsync();
 
+                // Note: the Oracle MySQL provider doesn't support DateTimeOffset and is unable
+                // to create a SQL query with an expression calling DateTimeOffset.UtcDateTime.
+                // To work around this limitation, the threshold represented as a DateTimeOffset
+                // instance is manually converted to a UTC DateTime instance outside the query.
+                var date = threshold.UtcDateTime;
+
                 var tokens = await
                     (from token in Tokens.AsTracking()
-                     where token.CreationDate < threshold.UtcDateTime
+                     where token.CreationDate < date
                      where (token.Status != Statuses.Inactive && token.Status != Statuses.Valid) ||
                            (token.Authorization != null && token.Authorization.Status != Statuses.Valid) ||
                             token.ExpirationDate < DateTime.UtcNow

src/OpenIddict.Server/OpenIddictServerHandlers.Authentication.cs

@@ -1588,9 +1588,9 @@ namespace OpenIddict.Server
 
                     Debug.Assert(!string.IsNullOrEmpty(context.ClientId), SR.FormatID4000(Parameters.ClientId));
 
-                    // If a code_challenge was provided, the request is always considered valid,
+                    // If a code_challenge was provided or if no authorization code is requested, the request is always
-                    // whether the proof key for code exchange requirement is enforced or not.
+                    // considered valid, whether the proof key for code exchange requirement is enforced or not.
-                    if (!string.IsNullOrEmpty(context.Request.CodeChallenge))
+                    if (!string.IsNullOrEmpty(context.Request.CodeChallenge) || !context.Request.HasResponseType(ResponseTypes.Code))
                     {
                         return;
                     }

test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Authentication.cs

@@ -1734,6 +1734,63 @@ namespace OpenIddict.Server.IntegrationTests
                 Requirements.Features.ProofKeyForCodeExchange, It.IsAny<CancellationToken>()), Times.Never());
         }
 
+        [Fact]
+        public async Task ValidateAuthorizationRequest_RequestIsValidatedWhenCodeIsNotRequestedWithPkceFeatureEnforced()
+        {
+            // Arrange
+            var application = new OpenIddictApplication();
+
+            var manager = CreateApplicationManager(mock =>
+            {
+                mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(application);
+
+                mock.Setup(manager => manager.ValidateRedirectUriAsync(application, "http://www.fabrikam.com/path", It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(true);
+
+                mock.Setup(manager => manager.HasRequirementAsync(application,
+                    Requirements.Features.ProofKeyForCodeExchange, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(true);
+            });
+
+            await using var server = await CreateServerAsync(options =>
+            {
+                options.SetRevocationEndpointUris(Array.Empty<Uri>());
+                options.DisableAuthorizationStorage();
+                options.DisableTokenStorage();
+                options.DisableSlidingRefreshTokenExpiration();
+
+                options.Services.AddSingleton(manager);
+
+                options.AddEventHandler<HandleAuthorizationRequestContext>(builder =>
+                    builder.UseInlineHandler(context =>
+                    {
+                        context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
+                            .SetClaim(Claims.Subject, "Bob le Magnifique");
+
+                        return default;
+                    }));
+            });
+
+            await using var client = await server.CreateClientAsync();
+
+            // Act
+            var response = await client.PostAsync("/connect/authorize", new OpenIddictRequest
+            {
+                ClientId = "Fabrikam",
+                RedirectUri = "http://www.fabrikam.com/path",
+                ResponseType = ResponseTypes.Token
+            });
+
+            // Assert
+            Assert.Null(response.Code);
+            Assert.NotNull(response.AccessToken);
+
+            Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
+            Mock.Get(manager).Verify(manager => manager.HasRequirementAsync(application,
+                Requirements.Features.ProofKeyForCodeExchange, It.IsAny<CancellationToken>()), Times.Never());
+        }
+
         [Theory]
         [InlineData("custom_error", null, null)]
         [InlineData("custom_error", "custom_description", null)]