Hello and sorry for the long PR. I will try to provide some details in the description to make it easier to review
OAuth2 support:
clients (apps) catalog in the user profile
option to register your client
option to mark you client public to be available for other users
authorization_code and refresh_token grants are supported
there's also a simple sample app in PHP to test the flow
Security:
access_token ttl is 7 days
authorization code ttl is 5 minutes
access token format is JWT, hash of it is saved into db, hash of refresh_token is saved in db
when a client is deleted by owner or it's authorization is removed by a user ("uninstall") then tokens are marked as revoked, revoke status is loaded to cache on backend start
Running locally
Run migration and make sure to edit .env by adding these new variables (you need to generate the secret key or you this sample one):
Hello and sorry for the long PR. I will try to provide some details in the description to make it easier to review
OAuth2 support:
authorization_codeandrefresh_tokengrants are supportedSecurity:
Running locally
Run migration and make sure to edit
.envby adding these new variables (you need to generate the secret key or you this sample one):Screenshots:
Empty catalog
Empty catalog on mobile
Register app on mobile
Register app on desktop
Newly created client app
Catalog of public or installed apps (if an app is private but you have it installed, you will see it with an option to uninstall)
Catalog on mobile
Consent screen
Consent screen on mobile