From b2f26173480a3273fae6bd02c073bd1f81122281 Mon Sep 17 00:00:00 2001
From: cclohmar <claus@sechpoint.com>
Date: Mon, 16 Mar 2026 16:55:37 +0000
Subject: [PATCH] chore: auto-commit 2026-03-16 16:55

---
 app/core/config.py | 26 ++++++++++++++++++++++++++
 install.sh         |  5 ++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/app/core/config.py b/app/core/config.py
index 0b5aae1..5a6ac24 100644
--- a/app/core/config.py
+++ b/app/core/config.py
@@ -1,6 +1,7 @@
 from pydantic_settings import BaseSettings
 from typing import Optional, List
 from pydantic import field_validator, ConfigDict
+import json
 
 
 class Settings(BaseSettings):
@@ -46,6 +47,31 @@ class Settings(BaseSettings):
             )
         return v
     
+    @field_validator('oauth2_supported_scopes', 'oauth2_supported_grant_types', mode='before')
+    @classmethod
+    def parse_list_from_string(cls, v):
+        """Parse list from either JSON string or space/comma-separated string."""
+        if isinstance(v, list):
+            return v
+        if isinstance(v, str):
+            # Try to parse as JSON first
+            try:
+                return json.loads(v)
+            except json.JSONDecodeError:
+                # If not JSON, try comma-separated or space-separated
+                # Remove quotes and split by commas or spaces
+                v = v.strip()
+                if ',' in v:
+                    # Comma-separated
+                    items = [item.strip().strip('"\'') for item in v.split(',')]
+                else:
+                    # Space-separated
+                    items = [item.strip().strip('"\'') for item in v.split()]
+                # Filter out empty strings
+                return [item for item in items if item]
+        # Return as-is for other types (should be list)
+        return v
+    
     model_config = ConfigDict(env_file=".env")
 
 
diff --git a/install.sh b/install.sh
index 9ef5a6e..7cac799 100644
--- a/install.sh
+++ b/install.sh
@@ -217,7 +217,10 @@ LOG_LEVEL=INFO
 OAUTH2_ISSUER=http://localhost:${PORT}
 OAUTH2_ACCESS_TOKEN_EXPIRE_MINUTES=30
 OAUTH2_REFRESH_TOKEN_EXPIRE_DAYS=7
-OAUTH2_SUPPORTED_SCOPES=openid profile email api:read api:write
+OAUTH2_AUTHORIZATION_CODE_EXPIRE_MINUTES=10
+OAUTH2_SUPPORTED_GRANT_TYPES=["authorization_code", "client_credentials", "refresh_token"]
+OAUTH2_SUPPORTED_SCOPES=["openid", "profile", "email", "api:read", "api:write"]
+OAUTH2_PKCE_REQUIRED=false
 
 # Server Settings
 HOST=0.0.0.0