Add OAuth2 authorization page for authorization code flow#739
Conversation
- Regenerate API client to include OAuth types from swagger - Add internal data model for OAuth client metadata (OAuthClient.ts) - Add useOAuthClient hook to fetch client metadata - Add useOAuthAuthorize hook for authorization mutation - Add OAuthAuthorizePage component with approve/decline UI - Add /oauth/authorize route under _auth layout (requires auth) - Add i18n translations for OAuth scopes (de, en, es, fr, it) - Add 28 tests (data mapping, route validation, component behavior)
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
aura-historia-staging | ca23633 | Commit Preview URL Branch Preview URL |
May 31 2026, 11:44 AM |
|
|
@copilot solid start. The backend added additional fields for oauth-client metadata, see Changelog. Please use them to display the app logo and subtly provide links to ToS, Privacy policy and client-uri (more information about the client). Keep in mind users are NON-TECHNICAL. Also please display the required scopes: display the scope tag as provided by backend AND display an internationalized short description (probably one short sentence is enough) description of what each required scope entails/does. |
Addressed in |
|
Can you take a look at this? Exactly what I wanted but I cannot get the "Approve" action working (oauth redirect). Use below example URL: |
Implements the webapp-side OAuth2 authorization code flow. Users are presented with a consent screen showing the requesting application's metadata and requested scopes, and can approve or decline access.
API Client
OAuthClientMetadataResponseData,OauthAuthorizeData,AccessTokenScopeData, etc.)logo_uri,client_uri,policy_uri,tos_uri)Route & Page
/_auth/oauth/authorize— protected route with Zod search param validation forclient_id,redirect_uri,code_challenge(required) andscope,state(optional)OAuthAuthorizePage— consent UI showing client name, app logo, subtle links to client information / privacy policy / terms of service, required scope tags as provided by the backend, short internationalized scope descriptions, security note, approve/decline actionsGET /api/v1/oauth/authorizewith PKCE params, follows redirectredirect_uriwitherror=access_deniedandstateper RFC 6749 §4.1.2.1Hooks & Data Layer
useOAuthClient(clientId)— fetches client metadata viaGET /api/v1/oauth/clients/{clientId}useOAuthAuthorize()— mutation wrapping the authorize endpointOAuthClientinternal model stripsclient_secretandclient_id_issued_atwhile mapping the new client URI metadata fields needed by the consent UIi18n
oauth.scopes.products_write/oauth.scopes.shops_managewith short descriptions for non-technical usersTests (29)