feat: add oauth2 client support #2098

cemalkilic · 2025-07-31T13:58:12Z

Summary

This PR implements OAuth2 client support in Supabase Auth, enabling applications to register OAuth clients programmatically. This is a foundational step toward full OAuth 2.1 server compliance.

Features Added

Client Registration Endpoints

Manual Registration (POST /admin/oauth/clients) - Admin-only endpoint for manual client registration
Dynamic Registration (POST /oauth/clients/register) - OAuth 2 Dynamic Client Registration compliant endpoint (configurable by env variable)

Client Management Endpoints

List Clients (GET /admin/oauth/clients) - List all registered OAuth
Get Client (GET /admin/oauth/clients/{client_id}) - Retrieve specific client
Delete Client (DELETE /admin/oauth/clients/{client_id}) - Soft-delete OAuth clients

Notes on Technical Implementation

Database Schema

New oauth_clients table
Indexing & soft-delete support

Code Organization

New internal/api/oauthserver package for OAuth server functionality. This package aimed to include all oauth server code. Note that Supabase Auth as of today is already a OAuth client to other OAuth Providers (i.e google)
Shared utilities in internal/api/shared to avoid circular dependencies. Planning to move the necessary code as we go. Started with sendJSON function.
Comprehensive test coverage with both unit and integration tests

Quick Test

Register a new OAuth client:

curl -X POST http://localhost:9999/oauth/clients/register \
    -H "Content-Type: application/json" \
    -d '{
      "client_name": "My App",
      "redirect_uris": ["https://myapp.example.com/callback"]
    }'

Important Note

There is no breaking change in this PR. This is purely additive functionality that doesn't affect existing authentication flows.

coveralls · 2025-07-31T14:12:48Z

Pull Request Test Coverage Report for Build 16803992205

Details

358 of 448 (79.91%) changed or added relevant lines in 13 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage increased (+0.2%) to 70.825%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/oauthserver/utils.go	7	9	77.78%
internal/api/shared/http.go	7	9	77.78%
internal/api/middleware.go	8	22	36.36%
internal/models/oauth_client.go	82	96	85.42%
internal/api/oauthserver/service.go	119	135	88.15%
internal/api/oauthserver/auth.go	12	29	41.38%
internal/api/oauthserver/handlers.go	88	113	77.88%

Totals
Change from base Build 16772506231:	0.2%
Covered Lines:	12235
Relevant Lines:	17275

💛 - Coveralls

hf

Really good!

internal/api/oauthserver/auth.go

internal/api/api.go

internal/api/oauthserver/handlers.go

internal/api/oauthserver/service.go

migrations/20250731150234_add_oauth_clients_table.up.sql

hf

🚢

What is this?

cstockton

👍

migrations/20250731150234_add_oauth_clients_table.up.sql

🤖 I have created a release *beep* *boop* --- ## [2.179.0](v2.178.0...v2.179.0) (2025-08-28) ### Features * add oauth2 client support ([#2098](#2098)) ([8fae015](8fae015)) * experimental own linking domains per provider ([#2119](#2119)) ([747bf3b](747bf3b)) * fetch email from snapchat oauth provider if available for consistency ([#2110](#2110)) ([7507822](7507822)) * implement link identity with oidc / native sign in ([#2108](#2108)) ([5f0ec87](5f0ec87)) * implements email-less accounts with oauth ([#2105](#2105)) ([9a61dae](9a61dae)) * introduce request-scoped background tasks & async mail sending ([#2126](#2126)) ([2c8ea61](2c8ea61)) * refactor mailer client wiring and add validation wrapper ([#2130](#2130)) ([68c40a6](68c40a6)) * support multiple `aud` for the external providers ([#2117](#2117)) ([ca5792e](ca5792e)) * use `slices.Contains` instead of for loops ([#2111](#2111)) ([9f22682](9f22682)) ### Bug Fixes * add `id-token` permission to ci ([#2143](#2143)) ([79209c0](79209c0)) * add missing param ([#2125](#2125)) ([c0b75f6](c0b75f6)) * change s3 artifact upload role ([#2145](#2145)) ([767e371](767e371)) * remove requirement of empty content-type on 204 ([#2128](#2128)) ([ecc97e0](ecc97e0)) * run release-please again ([#2144](#2144)) ([2560f14](2560f14)) * stripped binary now includes version ([#2147](#2147)) ([609f169](609f169)) * update copyright year in LICENSE ([#2142](#2142)) ([67fe0b0](67fe0b0)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

# Summary This PR implements the OAuth 2.1 authorization endpoint in Supabase Auth, completing the server-side OAuth flow by adding user authorization and consent management. Building on the OAuth client registration foundation (#2098), this enables Supabase Auth to function as an OAuth 2.1 authorization server. # Features Added ## Authorization Flow Endpoints - **Authorization Initiation** (`GET /oauth/authorize`) - Initiates OAuth 2.1 authorization code flow with PKCE support and redirects user to (for now) pre-configured url - **Authorization Details** (`GET /oauth/authorizations/{authorization_id}`) - Retrieves authorization request details for consent UI - **Consent Processing** (`POST /oauth/authorizations/{authorization_id}/consent`) - Handles user consent decisions (approve/deny) ## Authorization Management - **PKCE Enforcement** - Mandatory PKCE (RFC 7636) with S256/Plain support for OAuth 2.1 compliance - **User Consent Tracking** - Persistent consent storage with scope-based auto-approval for trusted clients - **State Management** - Complete authorization lifecycle management (pending → approved/denied/expired) - **Security Controls** - Authorization expiration, redirect URI validation # Technical Implementation ## Database Schema - New `oauth_authorizations` table for authorization requests with status tracking - New `oauth_consents` table for persistent user consent management - Enhanced enums for authorization status and response types - Comprehensive indexing for performance and cleanup operations ## Code Organization - Extended `internal/api/oauthserver` package with authorization flow handlers - New models: `OAuthServerAuthorization`, `OAuthServerConsent`, and scope utilities - Shared PKCE utilities extracted to `internal/models/pkce.go` for reuse - Context utilities moved to `internal/api/shared` to avoid circular dependencies # Future Work - **Integration Tests** - Add comprehensive integration tests for authorization flow handlers - **Audit Logging** - Enhanced audit logging for authorization decisions and consent management - **Scope Enforcement** - Currently scope handling provides future extensibility without active enforcement/utilization

feat: add oauth2 client support

944c7a2

cemalkilic requested a review from a team as a code owner July 31, 2025 13:58

cemalkilic added 2 commits July 31, 2025 16:01

fix: rm nonexist id check

660b23e

fix: update test

5bf089a

hf reviewed Jul 31, 2025

View reviewed changes

cemalkilic added 2 commits August 4, 2025 10:57

fix: address PR comments

cdc4833

fix: update test for client_name length

080b812

hf reviewed Aug 4, 2025

View reviewed changes

migrations/20250731150234_add_oauth_clients_table.up.sql Outdated Show resolved Hide resolved

hf approved these changes Aug 4, 2025

View reviewed changes

cstockton approved these changes Aug 4, 2025

View reviewed changes

migrations/20250731150234_add_oauth_clients_table.up.sql Outdated Show resolved Hide resolved

cemalkilic and others added 2 commits August 5, 2025 10:16

fix: add namespace prefix to enum

e877dbc

Merge branch 'master' into cemal/oauth-provider-client

1bec822

cemalkilic merged commit 8fae015 into master Aug 7, 2025
5 checks passed

cemalkilic deleted the cemal/oauth-provider-client branch August 7, 2025 12:55

github-actions bot mentioned this pull request Aug 7, 2025

chore(master): release 2.179.0 #2106

Merged

cemalkilic mentioned this pull request Aug 7, 2025

feat: implement OAuth2 authorization endpoint #2107

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add oauth2 client support #2098

feat: add oauth2 client support #2098

Uh oh!

cemalkilic commented Jul 31, 2025

Uh oh!

coveralls commented Jul 31, 2025 •

edited

Loading

Uh oh!

hf left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hf left a comment

Uh oh!

cstockton left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

feat: add oauth2 client support #2098

feat: add oauth2 client support #2098

Uh oh!

Conversation

cemalkilic commented Jul 31, 2025

Summary

Features Added

Client Registration Endpoints

Client Management Endpoints

Notes on Technical Implementation

Database Schema

Code Organization

Quick Test

Important Note

Uh oh!

coveralls commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 16803992205

Details

💛 - Coveralls

Uh oh!

hf left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hf left a comment

Choose a reason for hiding this comment

Uh oh!

cstockton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coveralls commented Jul 31, 2025 •

edited

Loading