coder · ThomasK33 · Jul 12, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
@@ -1206,6 +1206,7 @@ func OAuth2ProviderApp(t testing.TB, db database.Store, seed database.OAuth2Prov
 		RedirectUris:            takeFirstSlice(seed.RedirectUris, []string{"http://localhost"}),
 		ClientType:              takeFirst(seed.ClientType, sql.NullString{String: "confidential", Valid: true}),
 		DynamicallyRegistered:   takeFirst(seed.DynamicallyRegistered, sql.NullBool{Bool: false, Valid: true}),
+		UserID:                  takeFirst(seed.UserID, uuid.NullUUID{Valid: false}),
 		ClientIDIssuedAt:        takeFirst(seed.ClientIDIssuedAt, sql.NullTime{}),
 		ClientSecretExpiresAt:   takeFirst(seed.ClientSecretExpiresAt, sql.NullTime{}),
 		GrantTypes:              takeFirstSlice(seed.GrantTypes, []string{"authorization_code", "refresh_token"}),

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/foreign_key_constraint.go b/coderd/database/foreign_key_constraint.go
diff --git a/coderd/database/migrations/000352_add_user_id_to_oauth2_provider_apps.down.sql b/coderd/database/migrations/000352_add_user_id_to_oauth2_provider_apps.down.sql
@@ -0,0 +1,7 @@
+-- Restore refresh_hash as NOT NULL (existing data should still be valid)
+ALTER TABLE oauth2_provider_app_tokens
+ALTER COLUMN refresh_hash SET NOT NULL;
+
+-- Remove user_id column from OAuth2 provider apps
+ALTER TABLE oauth2_provider_apps
+DROP COLUMN user_id;
diff --git a/coderd/database/migrations/000352_add_user_id_to_oauth2_provider_apps.up.sql b/coderd/database/migrations/000352_add_user_id_to_oauth2_provider_apps.up.sql
@@ -0,0 +1,8 @@
+-- Add user ownership to OAuth2 provider apps for client credentials support
+ALTER TABLE oauth2_provider_apps
+ADD COLUMN user_id uuid REFERENCES users(id) ON DELETE CASCADE;
+
+-- Make refresh_hash nullable to support client credentials tokens
+-- RFC 6749 Section 4.4.3: "A refresh token SHOULD NOT be included" for client credentials
+ALTER TABLE oauth2_provider_app_tokens
+ALTER COLUMN refresh_hash DROP NOT NULL;
diff --git a/coderd/database/models.go b/coderd/database/models.go