From 004ae0c437b5c1f1ee254988630628186c1a80e3 Mon Sep 17 00:00:00 2001
From: Meysam Tamkin <meysam.tamkin@authlete.com>
Date: Thu, 20 Aug 2026 10:41:30 +0400
Subject: [PATCH] feat: add idTokenDroppedOnIssueWithoutOpenid flag to Service

Add a service flag indicating whether to refrain from issuing an ID token
when the "openid" scope has been removed from the scopes to be granted by
the "scopes" request parameter of the /auth/authorization/issue API.

The flag defaults to false, which preserves the existing behavior of
issuing an ID token based on the scopes of the original authorization
request. Flows whose response_type contains "id_token" are not affected,
because the response type itself requires an ID token.

Bump serialVersionUID and document the new methods in the changelogs.
---
 CHANGES.ja.md                                 |  8 ++
 CHANGES.md                                    |  8 ++
 .../java/com/authlete/common/dto/Service.java | 80 ++++++++++++++++++-
 3 files changed, 95 insertions(+), 1 deletion(-)

diff --git a/CHANGES.ja.md b/CHANGES.ja.md
index cc1bfc9e0..804ae1a30 100644
--- a/CHANGES.ja.md
+++ b/CHANGES.ja.md
@@ -1,6 +1,14 @@
 変更点
 ======
 
+4.48 (未リリース)
+-----------------
+
+- `Service` クラス
+    * `isIdTokenDroppedOnIssueWithoutOpenid()` メソッドを追加。
+    * `setIdTokenDroppedOnIssueWithoutOpenid(boolean)` メソッドを追加。
+
+
 4.47 (2026 年 07 月 09 日)
 -----------------
 
diff --git a/CHANGES.md b/CHANGES.md
index 3f05fed0b..d438c9d2d 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,6 +1,14 @@
 CHANGES
 =======
 
+4.48 (Unreleased)
+-----------------
+
+- `Service` class
+    * Added the `isIdTokenDroppedOnIssueWithoutOpenid()` method.
+    * Added the `setIdTokenDroppedOnIssueWithoutOpenid(boolean)` method.
+
+
 4.47 (2026-07-09)
 -----------------
 
diff --git a/src/main/java/com/authlete/common/dto/Service.java b/src/main/java/com/authlete/common/dto/Service.java
index 5837ec016..1c75742c7 100644
--- a/src/main/java/com/authlete/common/dto/Service.java
+++ b/src/main/java/com/authlete/common/dto/Service.java
@@ -330,7 +330,7 @@
  */
 public class Service implements Serializable
 {
-    private static final long serialVersionUID = 93L;
+    private static final long serialVersionUID = 94L;
 
 
     /*
@@ -2103,6 +2103,18 @@ public class Service implements Serializable
     private boolean backchannelLogoutSessionSupported;
 
 
+    /**
+     * The flag indicating whether to refrain from issuing an ID token when the
+     * {@code openid} scope has been removed from the scopes to be granted by
+     * the {@code scopes} request parameter of the
+     * {@code /auth/authorization/issue} API.
+     *
+     * @since 4.48
+     * @since Authlete 3.0.36
+     */
+    private boolean idTokenDroppedOnIssueWithoutOpenid;
+
+
     /**
      * Get the service number.
      *
@@ -13965,4 +13977,70 @@ public Service setBackchannelLogoutSessionSupported(boolean supported)
 
         return this;
     }
+
+
+    /**
+     * Get the flag indicating whether to refrain from issuing an ID token when
+     * the {@code openid} scope has been removed from the scopes to be granted
+     * by the {@code scopes} request parameter of the
+     * {@code /auth/authorization/issue} API.
+     *
+     * <p>
+     * The {@code scopes} request parameter of the
+     * {@code /auth/authorization/issue} API can narrow down the scopes that
+     * were requested by the original authorization request. When the
+     * {@code openid} scope is removed in this way, the {@code scope} of the
+     * issued access token no longer contains {@code openid}, but, for
+     * historical reasons, an ID token is issued nevertheless.
+     * </p>
+     *
+     * <p>
+     * When this flag is {@code true}, no ID token is issued in that case, so
+     * that ID token issuance follows the granted {@code openid} scope. Flows
+     * whose {@code response_type} contains {@code id_token} are not affected,
+     * because the response type itself requires an ID token.
+     * </p>
+     *
+     * @return
+     *         {@code true} if no ID token is issued when the {@code openid}
+     *         scope has been removed by the {@code scopes} request parameter
+     *         of the {@code /auth/authorization/issue} API.
+     *
+     * @since 4.48
+     * @since Authlete 3.0.36
+     */
+    public boolean isIdTokenDroppedOnIssueWithoutOpenid()
+    {
+        return idTokenDroppedOnIssueWithoutOpenid;
+    }
+
+
+    /**
+     * Set the flag indicating whether to refrain from issuing an ID token when
+     * the {@code openid} scope has been removed from the scopes to be granted
+     * by the {@code scopes} request parameter of the
+     * {@code /auth/authorization/issue} API.
+     *
+     * <p>
+     * See the description of {@link #isIdTokenDroppedOnIssueWithoutOpenid()}
+     * for details.
+     * </p>
+     *
+     * @param dropped
+     *         {@code true} to refrain from issuing an ID token when the
+     *         {@code openid} scope has been removed by the {@code scopes}
+     *         request parameter of the {@code /auth/authorization/issue} API.
+     *
+     * @return
+     *         {@code this} object.
+     *
+     * @since 4.48
+     * @since Authlete 3.0.36
+     */
+    public Service setIdTokenDroppedOnIssueWithoutOpenid(boolean dropped)
+    {
+        this.idTokenDroppedOnIssueWithoutOpenid = dropped;
+
+        return this;
+    }
 }