OpenAPI OAuth2 authorization-code onboarding backend

[RhysSullivan]

Plumbs the full OAuth2 authorization-code flow through the OpenAPI
plugin end-to-end: session persistence, plugin extension methods,
HTTP API endpoints, stored source config, and pre-request token
refresh in the invoker.

Types:

• OAuth2Auth class captures the per-source OAuth state (scheme
  name, flow, tokenUrl, client/access/refresh secret IDs, scopes,
  expiresAt). Persisted on the stored source config so refresh can
  run without a round-trip to the spec.
• OpenApiOAuthSession class for the pending start→complete session
  (spec text, namespace, name, baseUrl, headers, client secret IDs,
  PKCE verifier, scopes, flow URLs).
• InvocationConfig.oauth2: Option<OAuth2Auth> so the invoker can
  detect OAuth sources and refresh the access token before each
  request.
• SourceConfig.oauth2 field so the config persists across reloads.

Operation store:

• putOAuthSession / getOAuthSession / deleteOAuthSession on the
  interface; KV store adds a third scoped KV namespace keyed off
  ${ns}.oauth-sessions. In-memory store gets a third scoped KV.
• config-file-store inherits the new methods via its spread
  decoration.

Plugin extension:

• startOAuth(input): generate sessionId + PKCE verifier, persist
  the pending session (spec text + onboarding metadata), resolve the
  clientId secret, and build the authorization URL via
  @executor/plugin-oauth2's buildAuthorizationUrl. Returns the
  URL + sessionId + scopes to the frontend.
• completeOAuth({ state, code, error }): look up the session,
  delete it, call exchangeAuthorizationCode, store tokens via
  storeOAuthTokens, return an OpenApiOAuthCompleteResult carrying
  all the secret IDs. The frontend then calls addSpec with
  oauth2 set on the config.
• addSpec honors config.oauth2 by setting
  invocationConfig.oauth2 and writing the auth descriptor onto
  SourceConfig.oauth2.

Invoker:

• resolveOAuthAccessToken wraps
  @executor/plugin-oauth2's withRefreshedAccessToken with a
  secrets adapter and a persistAuth callback that writes the
  refreshed expiry / tokenType back to the stored source config.
  Runs before every request when the source has oauth2 set, and
  injects Authorization: Bearer <token> (overwriting any
  spec-declared Authorization header).

HTTP API:

• New endpoints on the openapi group: POST /oauth/start,
  POST /oauth/complete, GET /oauth/callback.
• oauthCallback uses runOAuthCallback from
  @executor/plugin-oauth2/http to render the popup HTML; channel
  name is executor:openapi-oauth-result.
• OpenApiOAuthError tagged error carries OAuth-specific failures
  through the API layer with status 400.

Only authorizationCode is wired end-to-end; clientCredentials is
declared in the preview flows but intentionally left for follow-up
work (it has a different shape — no popup, direct server-side
exchange — and can be added without schema changes since
OAuth2Preset already carries both flow kinds).

All 29 packages typecheck; the existing 32 openapi tests pass
unchanged.

[RhysSullivan]

• OpenAPI OAuth2 onboarding UI #252
• OpenAPI OAuth2 authorization-code onboarding backend #251 👈 (View in Graphite)
• Extract OAuth2 flows from OpenAPI security schemes #250
• Add storeOAuthTokens + withRefreshedAccessToken refresh wrapper #249
• Add OAuth popup UI utilities to @executor/plugin-oauth2 #248
• Extract @executor/plugin-oauth2 shared helpers #247
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	cc15929	Commit Preview URL	Apr 15 2026, 06:09 PM

[pkg-pr-new]

Open in StackBlitz

@executor/sdk

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/sdk@251

@executor/plugin-file-secrets

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-file-secrets@251

@executor/plugin-google-discovery

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-google-discovery@251

@executor/plugin-graphql

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-graphql@251

@executor/plugin-keychain

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-keychain@251

@executor/plugin-mcp

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-mcp@251

@executor/plugin-oauth2

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-oauth2@251

@executor/plugin-onepassword

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-onepassword@251

@executor/plugin-openapi

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-openapi@251

@executor/plugin-workos-vault

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-workos-vault@251

commit: b5a0beb

[RhysSullivan]

Merge activity

• Apr 15, 6:43 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Apr 15, 6:49 AM UTC: Graphite couldn't merge this pull request because a downstack PR Extract OAuth2 flows from OpenAPI security schemes #250 failed to merge.
• Apr 15, 6:05 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Apr 15, 6:06 PM UTC: Graphite couldn't merge this PR because it had merge conflicts.