# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1751552318 -7200
# Node ID 578fa5d97daa53e908621d0c11bdd921e5a98276
# Parent  17d9533f7596b5d409c7d2142fed459ddfa6766a
mod_http_oauth2: Avoid tripping on redirect URIs when omitted

Since device clients don't need to include redirect_uris, this function
needs to handle that case and not try to index the missing array.

diff -r 17d9533f7596 -r 578fa5d97daa mod_http_oauth2/mod_http_oauth2.lua
--- a/mod_http_oauth2/mod_http_oauth2.lua	Thu Jul 03 15:45:00 2025 +0200
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Thu Jul 03 16:18:38 2025 +0200
@@ -381,7 +381,9 @@
 		end
 		-- Tried to use device authorization flow without registering it.
 		return;
-	elseif not query_redirect_uri and client.redirect_uris then
+	elseif not client.redirect_uris then
+		return;
+	elseif not query_redirect_uri then
 		if #client.redirect_uris ~= 1 then
 			-- Client registered multiple URIs, it needs specify which one to use
 			return;