Jul 12, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
 RedirectUris:            takeFirstSlice(seed.RedirectUris, []string{"http://localhost"}),
 ClientType:              takeFirst(seed.ClientType, sql.NullString{String: "confidential", Valid: true}),
 DynamicallyRegistered:   takeFirst(seed.DynamicallyRegistered, sql.NullBool{Bool: false, Valid: true}),
 UserID:                  takeFirst(seed.UserID, uuid.NullUUID{Valid: false}),
 ClientIDIssuedAt:        takeFirst(seed.ClientIDIssuedAt, sql.NullTime{}),
 ClientSecretExpiresAt:   takeFirst(seed.ClientSecretExpiresAt, sql.NullTime{}),
 GrantTypes:              takeFirstSlice(seed.GrantTypes, []string{"authorization_code", "refresh_token"}),
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/foreign_key_constraint.go b/coderd/database/foreign_key_constraint.go
diff --git a/coderd/database/migrations/000352_add_user_id_to_oauth2_provider_apps.down.sql b/coderd/database/migrations/000352_add_user_id_to_oauth2_provider_apps.down.sql
 -- Restore refresh_hash as NOT NULL (existing data should still be valid)
 ALTER TABLE oauth2_provider_app_tokens
 ALTER COLUMN refresh_hash SET NOT NULL;

 -- Remove user_id column from OAuth2 provider apps
 ALTER TABLE oauth2_provider_apps
 DROP COLUMN user_id;
diff --git a/coderd/database/migrations/000352_add_user_id_to_oauth2_provider_apps.up.sql b/coderd/database/migrations/000352_add_user_id_to_oauth2_provider_apps.up.sql
 -- Add user ownership to OAuth2 provider apps for client credentials support
 ALTER TABLE oauth2_provider_apps
 ADD COLUMN user_id uuid REFERENCES users(id) ON DELETE CASCADE;

 -- Make refresh_hash nullable to support client credentials tokens
 -- RFC 6749 Section 4.4.3: "A refresh token SHOULD NOT be included" for client credentials
 ALTER TABLE oauth2_provider_app_tokens
 ALTER COLUMN refresh_hash DROP NOT NULL;
diff --git a/coderd/database/models.go b/coderd/database/models.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1206,6 +1206,7 @@ func OAuth2ProviderApp(t testing.TB, db database.Store, seed database.OAuth2Prov
		RedirectUris: takeFirstSlice(seed.RedirectUris, []string{"http://localhost"}),
		ClientType: takeFirst(seed.ClientType, sql.NullString{String: "confidential", Valid: true}),
		DynamicallyRegistered: takeFirst(seed.DynamicallyRegistered, sql.NullBool{Bool: false, Valid: true}),
		UserID: takeFirst(seed.UserID, uuid.NullUUID{Valid: false}),
		ClientIDIssuedAt: takeFirst(seed.ClientIDIssuedAt, sql.NullTime{}),
		ClientSecretExpiresAt: takeFirst(seed.ClientSecretExpiresAt, sql.NullTime{}),
		GrantTypes: takeFirstSlice(seed.GrantTypes, []string{"authorization_code", "refresh_token"}),
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,7 @@
		-- Restore refresh_hash as NOT NULL (existing data should still be valid)
		ALTER TABLE oauth2_provider_app_tokens
		ALTER COLUMN refresh_hash SET NOT NULL;

		-- Remove user_id column from OAuth2 provider apps
		ALTER TABLE oauth2_provider_apps
		DROP COLUMN user_id;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,8 @@
		-- Add user ownership to OAuth2 provider apps for client credentials support
		ALTER TABLE oauth2_provider_apps
		ADD COLUMN user_id uuid REFERENCES users(id) ON DELETE CASCADE;

		-- Make refresh_hash nullable to support client credentials tokens
		-- RFC 6749 Section 4.4.3: "A refresh token SHOULD NOT be included" for client credentials
		ALTER TABLE oauth2_provider_app_tokens
		ALTER COLUMN refresh_hash DROP NOT NULL;