From 62910a40dea91b1d60a83835ebb8eb70739226d4 Mon Sep 17 00:00:00 2001
From: Patrick Lee Scott <pat@patscott.io>
Date: Tue, 1 Sep 2026 13:02:11 -0500
Subject: [PATCH] fix: bound OIDC redirect schema validation

---
 apis/oidcclients/definition.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/apis/oidcclients/definition.yaml b/apis/oidcclients/definition.yaml
index 96de679..dc909bd 100644
--- a/apis/oidcclients/definition.yaml
+++ b/apis/oidcclients/definition.yaml
@@ -36,17 +36,19 @@ spec:
                 description: Exact OIDC callback URIs. Zitadel does not support wildcard redirects.
                 type: array
                 minItems: 1
-                uniqueItems: true
+                maxItems: 32
                 items:
                   type: string
                   format: uri
+                  maxLength: 2048
               postLogoutRedirectUris:
                 description: Exact destinations allowed after logout.
                 type: array
-                uniqueItems: true
+                maxItems: 32
                 items:
                   type: string
                   format: uri
+                  maxLength: 2048
               connectionSecretRef:
                 description: Secret written in the OIDCClient namespace with generated client credentials.
                 type: object