supabase / auth / 19097235750

69%

push

github

feat(oauthserver): add authorization list and revoke endpoints (#2232)

## Summary

This PR adds user-facing endpoints that allow users to view and revoke
their OAuth 2.1 client authorizations. This will allow users control
over which applications have access to their accounts.

  ## Changes

  ### New Endpoints

  #### `GET /user/oauth/authorizations`
  Lists all OAuth clients the authenticated user has authorized.

  **Response:**
  ```json
  {
    "authorized_clients": [
      {
        "client_id": "uuid",
        "client_name": "Example App",
        "client_uri": "https://example.com",
        "logo_uri": "https://example.com/logo.png",
        "scopes": ["read", "write"],
        "granted_at": "2025-10-29T12:00:00Z"
      }
    ]
  }
```

#### DELETE /user/oauth/authorizations?client_id={client_id}

Revokes authorization for a specific OAuth client.

 Actions performed:
  - Marks the user's consent as revoked
  - Deletes all active sessions associated with the OAuth client
  - Creates an audit log entry

  **Response**: 204 No Content on success

73 of 91 new or added lines in 3 files covered. (80.22%)

13997 of 20477 relevant lines covered (68.35%)

78.86 hits per line