Provider configs (GoogleProviderConfig, GithubProviderConfig) are
structurally assignable, so the full provider config can be passed.
Throws when redirectAllowlist holds an entry that could never match — see
normalizeAllowlist. An absent allowlist does not throw: a deployment
that never accepts redirect_to is correctly configured, and its refusal
surfaces on the request that actually asks for a redirect.
Default
FederationRedirectPolicyfactory.Provider configs (
GoogleProviderConfig,GithubProviderConfig) are structurally assignable, so the full provider config can be passed.Throws when
redirectAllowlistholds an entry that could never match — seenormalizeAllowlist. An absent allowlist does not throw: a deployment that never acceptsredirect_tois correctly configured, and its refusal surfaces on the request that actually asks for a redirect.