Skip to content

Add schemas for OAuth entities - #6636

Merged
apata merged 2 commits into
masterfrom
mcp/oauth-schemas
Sep 3, 2026
Merged

Add schemas for OAuth entities#6636
apata merged 2 commits into
masterfrom
mcp/oauth-schemas

Conversation

@apata

@apata apata commented Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Changes

Adds schemas for OAuth entities. Based on the requirements in https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/15/.

Definitions for Plausible MCP use case

  • Protected Resource: User's sites and stats via /mcp endpoint on Plausible app server
  • Resource Owner: user of Plausible
  • Client: browser launched by Claude Code
  • Authorization Server: Plausible app server
  • Resource Server: Plausible app server
        +--------+                               +---------------+
        |        |--(1)- Authorization Request ->|   Resource    |
        |        |                               |     Owner     |
        |        |<-(2)-- Authorization Grant ---|               |
        |        |                               +---------------+
        |        |
        |        |                               +---------------+
        |        |--(3)-- Authorization Grant -->| Authorization |
        | Client |                               |     Server    |
        |        |<-(4)----- Access Token -------|               |
        |        |                               +---------------+
        |        |
        |        |                               +---------------+
        |        |--(5)----- Access Token ------>|    Resource   |
        |        |                               |     Server    |
        |        |<-(6)--- Protected Resource ---|               |
        +--------+                               +---------------+

                      Figure 1: Abstract Protocol Flow

  +--------+                                           +---------------+
  |        |--(1)------- Authorization Grant --------->|               |
  |        |                                           |               |
  |        |<-(2)----------- Access Token -------------|               |
  |        |               & Refresh Token             |               |
  |        |                                           |               |
  |        |                            +----------+   |               |
  |        |--(3)---- Access Token ---->|          |   |               |
  |        |                            |          |   |               |
  |        |<-(4)- Protected Resource --| Resource |   | Authorization |
  | Client |                            |  Server  |   |     Server    |
  |        |--(5)---- Access Token ---->|          |   |               |
  |        |                            |          |   |               |
  |        |<-(6)- Invalid Token Error -|          |   |               |
  |        |                            +----------+   |               |
  |        |                                           |               |
  |        |--(7)----------- Refresh Token ----------->|               |
  |        |                                           |               |
  |        |<-(8)----------- Access Token -------------|               |
  +--------+           & Optional Refresh Token        +---------------+

               Figure 2: Refreshing an Expired Access Token

Tests

  • This PR does not require tests

Changelog

  • This PR does not make a user-facing change

Documentation

  • This change does not need a documentation update

Dark mode

  • This PR does not change the UI

@apata
apata requested a review from a team September 2, 2026 15:23
zoldar
zoldar approved these changes Sep 3, 2026
View reviewed changes
Comment thread lib/plausible/oauth/authorization_code.ex Outdated
@optional [:scopes, :client_name]

schema "oauth_authorization_codes" do
field :raw, :string, virtual: true

@zoldar zoldar Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the role of this field? Is it for storing code in-memory before hashing? Maybe naming could be improved slightly?

@apata apata Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @zoldar, good question! I added it to make OAuth related tests a bit shorter (I have a bunch of them locally, to be merged separately). I've now changed the testing approach from "this is what the functions return" -> "this is what happens in the DB", so it's not necessary any more.

Base automatically changed from mcp/oauth-tables to master September 3, 2026 10:51
@apata
apata force-pushed the mcp/oauth-schemas branch from 868e054 to 0dfd637 Compare September 3, 2026 10:51
@apata
apata added this pull request to the merge queue Sep 3, 2026
Merged via the queue into master with commit 543b301 Sep 3, 2026
23 checks passed
@apata
apata deleted the mcp/oauth-schemas branch September 3, 2026 11:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zoldar zoldar zoldar approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@apata @zoldar