Omar SobhandClaude Fable 5
91327e3618
- migration 0005 oauth_states: one-time states (10-min TTL), consumed by a CAS DELETE on callback — replays and forgeries both 404 - POST /api/apps/oauth/start: OIDC discovery on the configured issuer (or the custom MCP issuer for authType=mcp_oauth), state row, authorize URL - GET /api/apps/oauth/callback: code exchanged at the REAL token endpoint (client id+secret form POST); the access token goes straight to the broker (test proves it never appears unencrypted in Postgres); connection row + audit; redirects to the claw's Add Apps panel - [oauth] config (issuer/client/redirect_base) wired through AppState - Tests against a real local IdP server (discovery + validating token endpoint): full round trip, broker-held token, replay/forged state refused, bad code fails exchange, mcp_oauth uses the custom issuer while plain oauth refuses without a configured IdP - AddAppsApp: live connection badges + inline API-key connect per app (E2E: connect Notion by key from the directory) 136 Rust + 63 frontend tests + 21 Playwright journeys. Co-Authored-By: Claude Fable 5 <[email protected]>
16 lines
665 B
SQL
16 lines
665 B
SQL
-- Pending OAuth authorization-code flows (§7.8 / §10). One-time states:
|
|
-- consumed (deleted) on callback, swept on expiry.
|
|
|
|
CREATE TABLE oauth_states (
|
|
state TEXT PRIMARY KEY,
|
|
workspace_id UUID NOT NULL REFERENCES workspaces (id),
|
|
user_id UUID NOT NULL REFERENCES users (id),
|
|
agent_id UUID NOT NULL REFERENCES agents (id),
|
|
provider TEXT NOT NULL,
|
|
auth_type TEXT NOT NULL CHECK (auth_type IN ('oauth', 'mcp_oauth')),
|
|
-- Issuer for custom MCP servers; the configured default otherwise.
|
|
issuer_url TEXT NOT NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
expires_at TIMESTAMPTZ NOT NULL
|
|
);
|