supabase / auth
69%

DEFAULT BRANCH: master
Repo Added
Token 4bwRC3LZFPF44ZxCFKL8wNnCqKD2BNicB regen
Build 1080 Last
Files 161
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: SELECT
CHANGE BRANCH
x
Sync Branches

coverage: 68.707% (-2.0%) from 70.664%
17383331724

push

github

web-flow 
feat: implement OAuth2 authorization endpoint (#2107)

# Summary

This PR implements the OAuth 2.1 authorization endpoint in Supabase
Auth, completing the server-side OAuth flow by adding user authorization
and consent management. Building on the OAuth client registration
foundation (#2098), this enables Supabase Auth to function as an OAuth
2.1 authorization server.

# Features Added
## Authorization Flow Endpoints

- **Authorization Initiation** (`GET /oauth/authorize`) - Initiates
OAuth 2.1 authorization code flow with PKCE support and redirects user
to (for now) pre-configured url
- **Authorization Details** (`GET
/oauth/authorizations/{authorization_id}`) - Retrieves authorization
request details for consent UI
- **Consent Processing** (`POST
/oauth/authorizations/{authorization_id}/consent`) - Handles user
consent decisions (approve/deny)

## Authorization Management

- **PKCE Enforcement** - Mandatory PKCE (RFC 7636) with S256/Plain
support for OAuth 2.1 compliance
- **User Consent Tracking** - Persistent consent storage with
scope-based auto-approval for trusted clients
- **State Management** - Complete authorization lifecycle management
(pending → approved/denied/expired)
- **Security Controls** - Authorization expiration, redirect URI
validation

# Technical Implementation
## Database Schema

- New `oauth_authorizations` table for authorization requests with
status tracking
- New `oauth_consents` table for persistent user consent management  
- Enhanced enums for authorization status and response types
- Comprehensive indexing for performance and cleanup operations

## Code Organization

- Extended `internal/api/oauthserver` package with authorization flow
handlers
- New models: `OAuthServerAuthorization`, `OAuthServerConsent`, and
scope utilities
- Shared PKCE utilities extracted to `internal/models/pkce.go` for reuse
- Context utilities moved to `internal/api/shared` to avoid circular
dependencies

# Future Work

- **Integration Tests** - ... (continued)

205 of 785 new or added lines in 12 files covered. (26.11%)

12537 of 18247 relevant lines covered (68.71%)

67.13 hits per line

Relevant lines Covered
18247 RELEVANT LINES 12537 COVERED LINES
67.13 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
17383331724 master feat: implement OAuth2 authorization endpoint (#2107) # Summary This PR implements the OAuth 2.1 authorization endpoint in Supabase Auth, completing the server-side OAuth flow by adding user authorization and consent management. Building on the ... push web-flow github
68.71
17382355296 cemal/feat-add-oauth-authorize-endpoint fix: use the primary key of oauth_clients for FK Pull #2107 cemalkilic github
68.71
17376593411 cemal/feat-add-oauth-authorize-endpoint feat: add `.well-known/oauth-authorization-server` endpoint (#2124) ## What kind of change does this PR introduce? Adding `.well-known/oauth-authorization-server` endpoint per [RFC 8414](https://datatracker.ietf.org/doc/html/rfc8414) Pull #2107 cemalkilic github
68.71
17361858204 cs/background-template-reloading-p2 feat: mailer template cache & interface refactor - introduce shared template cache - centralize default subjects/bodies and validate at init - move templating into templatemailer - change mailer.Client.Mail signature to (subject, body, headers, t... Pull #2150 Chris Stockton github
70.92
17359661859 cs/feat-makefile-qol chore: replace Makefile dev-deps with per-tool check targets - Remove unused `soda` command - Could not find any reference to this - Remove `dev-deps` target that installed all cmds - Add dedicated check targets: - `check-gosec` installs gose... Pull #2149 Chris Stockton github
70.66
17359649920 cs/feat-makefile-qol makefile: replace dev-deps with per-tool check targets - Remove unused `soda` command - Could not find any reference to this - Remove `dev-deps` target that installed all cmds - Add dedicated check targets: - `check-gosec` installs gosec if m... Pull #2149 Chris Stockton github
70.66
17310237126 cs/background-template-reloading chore: remove duplicate import due to mailer -> mail alias Pull #2148 Chris Stockton github
70.66
17297186832 master chore(master): release 2.179.0 (#2106) :robot: I have created a release *beep* *boop* --- ## [2.179.0](https://github.com/supabase/auth/compare/v2.178.0...v2.179.0) (2025-08-28) ### Features * add oauth2 client support ([#2098](https://githu... push web-flow github
70.66
17294660645 master feat: implement link identity with oidc / native sign in (#2108) Implements linking an OIDC identity to a user. It works by modifying the existing `/token?grant_type=id_token` endpoint by allowing a `link_identity` body parameter. If it's set, t... push web-flow github
70.66
17293758063 hf/link-identity-oidc fix tests Pull #2108 hf github
70.66
See All Builds (1079)

Badge your Repo: auth

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh