feat: implement OAuth2 authorization endpoint #2107

cemalkilic · 2025-08-07T15:35:15Z

Summary

This PR implements the OAuth 2.1 authorization endpoint in Supabase Auth, completing the server-side OAuth flow by adding user authorization and consent management. Building on the OAuth client registration foundation (#2098), this enables Supabase Auth to function as an OAuth 2.1 authorization server.

Features Added

Authorization Flow Endpoints

Authorization Initiation (GET /oauth/authorize) - Initiates OAuth 2.1 authorization code flow with PKCE support and redirects user to (for now) pre-configured url
Authorization Details (GET /oauth/authorizations/{authorization_id}) - Retrieves authorization request details for consent UI
Consent Processing (POST /oauth/authorizations/{authorization_id}/consent) - Handles user consent decisions (approve/deny)

Authorization Management

PKCE Enforcement - Mandatory PKCE (RFC 7636) with S256/Plain support for OAuth 2.1 compliance
User Consent Tracking - Persistent consent storage with scope-based auto-approval for trusted clients
State Management - Complete authorization lifecycle management (pending → approved/denied/expired)
Security Controls - Authorization expiration, redirect URI validation

Technical Implementation

Database Schema

New oauth_authorizations table for authorization requests with status tracking
New oauth_consents table for persistent user consent management
Enhanced enums for authorization status and response types
Comprehensive indexing for performance and cleanup operations

Code Organization

Extended internal/api/oauthserver package with authorization flow handlers
New models: OAuthServerAuthorization, OAuthServerConsent, and scope utilities
Shared PKCE utilities extracted to internal/models/pkce.go for reuse
Context utilities moved to internal/api/shared to avoid circular dependencies

Future Work

Integration Tests - Add comprehensive integration tests for authorization flow handlers
Audit Logging - Enhanced audit logging for authorization decisions and consent management
Scope Enforcement - Currently scope handling provides future extensibility without active enforcement/utilization

migrations/20250804100000_add_oauth_authorizations_consents.up.sql

coveralls · 2025-08-07T15:47:52Z

Pull Request Test Coverage Report for Build 17382355296

Details

205 of 785 (26.11%) changed or added relevant lines in 12 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-2.0%) to 68.707%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/shared/context.go	12	15	80.0%
internal/api/oauthserver/handlers.go	3	28	10.71%
internal/models/oauth_consent.go	26	108	24.07%
internal/models/oauth_authorization.go	66	161	40.99%
internal/api/oauthserver/authorize.go	0	375	0.0%

Totals
Change from base Build 17297186832:	-2.0%
Covered Lines:	12537
Relevant Lines:	18247

💛 - Coveralls

internal/api/oauthserver/authorize.go

hf

Looks OK, feel free to make adjustments

internal/api/oauthserver/authorize.go

internal/models/flow_state.go

internal/models/oauth_authorization.go

internal/models/oauth_consent.go

internal/models/pkce.go

as we’re using the existing database enum, and it’s defined with `s256` and `plain`

`resource` param is being used in MCP auth to indicate which MCP server is being accessed we can provide the configuration of valid resources in the future. for now the plan is just to store during `/authorize` and validate if the same resource is being requested in the `/token` call

## What kind of change does this PR introduce? Adding `.well-known/oauth-authorization-server` endpoint per [RFC 8414](https://datatracker.ietf.org/doc/html/rfc8414)

🤖 I have created a release *beep* *boop* --- ## [2.180.0](v2.179.0...v2.180.0) (2025-09-23) ### Features * add OAuth client type ([#2152](#2152)) ([b118f1f](b118f1f)) * add phone to sms webhook payload ([#2160](#2160)) ([d475ac1](d475ac1)) * background template reloading p1 - baseline decomposition ([#2148](#2148)) ([746c937](746c937)) * config reloading with fsnotify, poller fallback, and signals ([#2161](#2161)) ([c77d512](c77d512)) * enhance issuer URL validation in OAuth server metadata ([#2164](#2164)) ([a9424d2](a9424d2)) * implement OAuth2 authorization endpoint ([#2107](#2107)) ([5318552](5318552)) * **oauth2:** add `/oauth/token` endpoint ([#2159](#2159)) ([a89a0b0](a89a0b0)) * **oauth2:** add admin endpoint to regenerate OAuth client secrets ([#2170](#2170)) ([0bd1c28](0bd1c28)) * **oauth2:** return redirect_uri on GET authorization ([#2175](#2175)) ([b0a0c3e](b0a0c3e)) * **oauth2:** use `id` field as the public client_id ([#2154](#2154)) ([86b7de4](86b7de4)) * **openapi:** add OAuth 2.1 server endpoints and clarify OAuth modes ([#2165](#2165)) ([1f804a2](1f804a2)) * password changed email notification ([#2176](#2176)) ([fe0fd04](fe0fd04)) * support `transfer_sub` in apple id tokens ([#2162](#2162)) ([8a71006](8a71006)) ### Bug Fixes * ensure request context exists in API db operations ([#2171](#2171)) ([060a992](060a992)) * **makefile:** remove invalid @ symbol from shell commands ([#2168](#2168)) ([e6afe45](e6afe45)) * **oauth2:** switch to Origin header for request validation ([#2174](#2174)) ([42bc9ab](42bc9ab)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

# Summary This PR implements the OAuth 2.1 authorization endpoint in Supabase Auth, completing the server-side OAuth flow by adding user authorization and consent management. Building on the OAuth client registration foundation (#2098), this enables Supabase Auth to function as an OAuth 2.1 authorization server. # Features Added ## Authorization Flow Endpoints - **Authorization Initiation** (`GET /oauth/authorize`) - Initiates OAuth 2.1 authorization code flow with PKCE support and redirects user to (for now) pre-configured url - **Authorization Details** (`GET /oauth/authorizations/{authorization_id}`) - Retrieves authorization request details for consent UI - **Consent Processing** (`POST /oauth/authorizations/{authorization_id}/consent`) - Handles user consent decisions (approve/deny) ## Authorization Management - **PKCE Enforcement** - Mandatory PKCE (RFC 7636) with S256/Plain support for OAuth 2.1 compliance - **User Consent Tracking** - Persistent consent storage with scope-based auto-approval for trusted clients - **State Management** - Complete authorization lifecycle management (pending → approved/denied/expired) - **Security Controls** - Authorization expiration, redirect URI validation # Technical Implementation ## Database Schema - New `oauth_authorizations` table for authorization requests with status tracking - New `oauth_consents` table for persistent user consent management - Enhanced enums for authorization status and response types - Comprehensive indexing for performance and cleanup operations ## Code Organization - Extended `internal/api/oauthserver` package with authorization flow handlers - New models: `OAuthServerAuthorization`, `OAuthServerConsent`, and scope utilities - Shared PKCE utilities extracted to `internal/models/pkce.go` for reuse - Context utilities moved to `internal/api/shared` to avoid circular dependencies # Future Work - **Integration Tests** - Add comprehensive integration tests for authorization flow handlers - **Audit Logging** - Enhanced audit logging for authorization decisions and consent management - **Scope Enforcement** - Currently scope handling provides future extensibility without active enforcement/utilization

🤖 I have created a release *beep* *boop* --- ## [2.180.0](v2.179.0...v2.180.0) (2025-09-23) ### Features * add OAuth client type ([#2152](#2152)) ([b118f1f](b118f1f)) * add phone to sms webhook payload ([#2160](#2160)) ([d475ac1](d475ac1)) * background template reloading p1 - baseline decomposition ([#2148](#2148)) ([746c937](746c937)) * config reloading with fsnotify, poller fallback, and signals ([#2161](#2161)) ([c77d512](c77d512)) * enhance issuer URL validation in OAuth server metadata ([#2164](#2164)) ([a9424d2](a9424d2)) * implement OAuth2 authorization endpoint ([#2107](#2107)) ([5318552](5318552)) * **oauth2:** add `/oauth/token` endpoint ([#2159](#2159)) ([a89a0b0](a89a0b0)) * **oauth2:** add admin endpoint to regenerate OAuth client secrets ([#2170](#2170)) ([0bd1c28](0bd1c28)) * **oauth2:** return redirect_uri on GET authorization ([#2175](#2175)) ([b0a0c3e](b0a0c3e)) * **oauth2:** use `id` field as the public client_id ([#2154](#2154)) ([86b7de4](86b7de4)) * **openapi:** add OAuth 2.1 server endpoints and clarify OAuth modes ([#2165](#2165)) ([1f804a2](1f804a2)) * password changed email notification ([#2176](#2176)) ([fe0fd04](fe0fd04)) * support `transfer_sub` in apple id tokens ([#2162](#2162)) ([8a71006](8a71006)) ### Bug Fixes * ensure request context exists in API db operations ([#2171](#2171)) ([060a992](060a992)) * **makefile:** remove invalid @ symbol from shell commands ([#2168](#2168)) ([e6afe45](e6afe45)) * **oauth2:** switch to Origin header for request validation ([#2174](#2174)) ([42bc9ab](42bc9ab)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

cemalkilic requested a review from a team as a code owner August 7, 2025 15:35

cemalkilic commented Aug 7, 2025

View reviewed changes

migrations/20250804100000_add_oauth_authorizations_consents.up.sql Show resolved Hide resolved

cemalkilic commented Aug 7, 2025

View reviewed changes

internal/api/oauthserver/authorize.go Show resolved Hide resolved

hf approved these changes Aug 7, 2025

View reviewed changes

cemalkilic force-pushed the cemal/feat-add-oauth-authorize-endpoint branch from 18a0614 to 4e9d9ee Compare August 27, 2025 08:10

cemalkilic and others added 14 commits September 1, 2025 13:43

feat: implement OAuth2 authorization endpoint

2d047dc

fix: gofmt

01115f4

chore: add omitempty for the response jsontags

d9e957f

chore: single line SQLs

1167bea

feat: append AuthorizationPath to site URL

aa17148

chore: mv pkce logic to security package

76d13bd

chore: NullString -> string pointer

d67a775

feat: enable oauth server based on config

b9c26ea

fix: normalize code challenge method to lowercase

4ae8fe8

as we’re using the existing database enum, and it’s defined with `s256` and `plain`

feat: redirect on errors if possible

c071b12

feat: add origin check for the GET/POST authorization

8f520ed

fix: error strings should not be capitalized

0c128e1

feat: add .well-known/oauth-authorization-server endpoint (#2124)

1a313d8

## What kind of change does this PR introduce? Adding `.well-known/oauth-authorization-server` endpoint per [RFC 8414](https://datatracker.ietf.org/doc/html/rfc8414)

cemalkilic force-pushed the cemal/feat-add-oauth-authorize-endpoint branch from 4e9d9ee to 1a313d8 Compare September 1, 2025 11:43

fix: use the primary key of oauth_clients for FK

563b033

cemalkilic merged commit 5318552 into master Sep 1, 2025
5 checks passed

cemalkilic deleted the cemal/feat-add-oauth-authorize-endpoint branch September 1, 2025 16:48

github-actions bot mentioned this pull request Sep 1, 2025

chore(master): release 2.180.0 #2151

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: implement OAuth2 authorization endpoint #2107

feat: implement OAuth2 authorization endpoint #2107

Uh oh!

cemalkilic commented Aug 7, 2025

Uh oh!

Uh oh!

coveralls commented Aug 7, 2025 •

edited

Loading

Uh oh!

Uh oh!

hf left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

feat: implement OAuth2 authorization endpoint #2107

feat: implement OAuth2 authorization endpoint #2107

Uh oh!

Conversation

cemalkilic commented Aug 7, 2025

Summary

Features Added

Authorization Flow Endpoints

Authorization Management

Technical Implementation

Database Schema

Code Organization

Future Work

Uh oh!

Uh oh!

coveralls commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 17382355296

Details

💛 - Coveralls

Uh oh!

Uh oh!

hf left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coveralls commented Aug 7, 2025 •

edited

Loading