Blame · Line-by-line history

`0111_oauth_dcr.sql`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

0111_oauth_dcr.sqlBlame27 lines · 1 contributor

4c27627ccanty labs	1	-- OAuth Dynamic Client Registration (RFC 7591).
	2	--
	3	-- Self-registering clients (claude.ai remote connectors, Cursor, Copilot,
	4	-- etc.) have NO human owner — they POST their metadata to /oauth/register and
	5	-- get back a client_id/secret. To allow that, owner_id becomes nullable and a
	6	-- `dynamically_registered` flag distinguishes these apps from human-created
	7	-- ones. Existing rows keep their owner and default to dynamically_registered
	8	-- = false, so nothing about the current developer-apps UI changes.
	9	--
	10	-- Additive + backward-compatible: the only code that reads owner_id filters
	11	-- "apps owned by user X" (developer-apps.tsx); a NULL owner simply never
	12	-- matches, so DCR apps are correctly invisible in any human's app list.
	13
	14	ALTER TABLE oauth_apps
	15	ALTER COLUMN owner_id DROP NOT NULL;
	16
	17	ALTER TABLE oauth_apps
	18	ADD COLUMN IF NOT EXISTS dynamically_registered BOOLEAN NOT NULL DEFAULT FALSE;
	19
	20	-- Optional per-RFC-7591 registration management token (hashed). Lets a client
	21	-- later read/update/delete its own registration without a user session.
	22	ALTER TABLE oauth_apps
	23	ADD COLUMN IF NOT EXISTS registration_access_token_hash TEXT;
	24
	25	CREATE INDEX IF NOT EXISTS idx_oauth_apps_dcr
	26	ON oauth_apps(dynamically_registered)
	27	WHERE dynamically_registered = TRUE;