feat(oauth2): add /oauth/token endpoint

[cemalkilic]

Summary

This PR completes the OAuth2 server implementation by adding the /token endpoint, enabling full OAuth2 authorization code flow & refresh token support.

Key Features Added:

OAuth Token Endpoint (POST /oauth/token) supporting:

• authorization_code grant type for exchanging authorization codes for access
• refresh_token grant type for token refresh
• Both JSON and form-encoded request bodies
• OAuth Client authentication via Basic auth or request body parameters (form params and JSON body)

Token Service Integration:

• Integrated OAuth server with the existing token service
• Added OAuth-specific authentication method (oauth_provider/authorization_code)
• Enhanced token generation to include OAuth client context in JWT claims.

Database Changes:

• Added oauth_client_id field to sessions table for OAuth client tracking. So an OAuth clients can use a refresh token only if the session is issued for them. Similarly, a session issued to a client can only be refreshed by that client (i.e user can't use /token?grant_type=refresh_token endpoint with a refresh token obtained through /oauth/token endpoint.)

Next Steps

• Adding ratelimit for the /token endpoint
• Store token auth method for oauth clients in the database

[coveralls]

Pull Request Test Coverage Report for Build 17646441416

Details

• 88 of 303 (29.04%) changed or added relevant lines in 13 files are covered.
• 13 unchanged lines in 2 files lost coverage.
• Overall coverage decreased (-0.8%) to 67.943%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/middleware.go	0	2	0.0%
internal/models/errors.go	0	2	0.0%
internal/models/refresh_token.go	1	3	33.33%
internal/api/shared/context.go	8	12	66.67%
internal/models/factor.go	0	4	0.0%
internal/models/oauth_client.go	0	7	0.0%
internal/tokens/service.go	43	57	75.44%
internal/api/oauthserver/auth.go	0	24	0.0%
internal/api/oauthserver/handlers.go	10	166	6.02%

Files with Coverage Reduction	New Missed Lines	%
internal/api/oauthserver/auth.go	6	0.0%
internal/api/middleware.go	7	75.99%

Totals
Change from base Build 17459483364:	-0.8%
Covered Lines:	12630
Relevant Lines:	18589

---

💛 - Coveralls

[cstockton]

Nothing jumps out at me, but I did see this in the handler.go that is a bit confusing to me. Given ClientSecret is not initialized I think it's essentially a NOOP. I think I understand the flow of the client secret, but can we remove the code / comment below to make it more clear?

func oauthServerClientToResponse(client *models.OAuthServerClient, includeSecret bool) *OAuthServerClientResponse {

// cstockton: ClientSecret is not set here

	response := &OAuthServerClientResponse{
		ClientID:   client.ID.String(),
		ClientType: client.ClientType,

		// OAuth 2.1 DCR fields
		RedirectURIs:            client.GetRedirectURIs(),
		TokenEndpointAuthMethod: tokenEndpointAuthMethods,
		GrantTypes:              client.GetGrantTypes(),
		ResponseTypes:           []string{"code"}, // Always "code" in OAuth 2.1
		ClientName:              utilities.StringValue(client.ClientName),
		ClientURI:               utilities.StringValue(client.ClientURI),
		LogoURI:                 utilities.StringValue(client.LogoURI),

		// Metadata fields
		RegistrationType: client.RegistrationType,
		CreatedAt:        client.CreatedAt,
		UpdatedAt:        client.UpdatedAt,
	}

	// Only include client_secret during registration and only for confidential clients
	if includeSecret && client.IsConfidential() {

// cstockton: So I don't entirely understand this, but would like to:

		// Note: This will be filled in by the handler with the plaintext secret
		response.ClientSecret = ""
	}

[cemalkilic]

Nothing jumps out at me, but I did see this in the handler.go that is a bit confusing to me. Given ClientSecret is not initialized I think it's essentially a NOOP. I think I understand the flow of the client secret, but can we remove the code / comment below to make it more clear?

func oauthServerClientToResponse(client *models.OAuthServerClient, includeSecret bool) *OAuthServerClientResponse {

// cstockton: ClientSecret is not set here

	response := &OAuthServerClientResponse{
		ClientID:   client.ID.String(),
		ClientType: client.ClientType,

		// OAuth 2.1 DCR fields
		RedirectURIs:            client.GetRedirectURIs(),
		TokenEndpointAuthMethod: tokenEndpointAuthMethods,
		GrantTypes:              client.GetGrantTypes(),
		ResponseTypes:           []string{"code"}, // Always "code" in OAuth 2.1
		ClientName:              utilities.StringValue(client.ClientName),
		ClientURI:               utilities.StringValue(client.ClientURI),
		LogoURI:                 utilities.StringValue(client.LogoURI),

		// Metadata fields
		RegistrationType: client.RegistrationType,
		CreatedAt:        client.CreatedAt,
		UpdatedAt:        client.UpdatedAt,
	}

	// Only include client_secret during registration and only for confidential clients
	if includeSecret && client.IsConfidential() {

// cstockton: So I don't entirely understand this, but would like to:

		// Note: This will be filled in by the handler with the plaintext secret
		response.ClientSecret = ""
	}

Good catch, yeah this part is unnecessary. I added this part before implementing #2152, so we don't need anymore, removed the includeSecret param 👍

[hf]

Please consider the index!