OAuth Applications Collection

oauthApplications holds the OAuth clients that web knows. One document is one client. In Ayakaleaf Pro the only writer is the git-bridge web module, which creates one client named Overleaf Git Bridge when web starts. The schema is services/web/app/src/models/OauthApplication.mjs.

Fields

Field	Type	Meaning	Source
_id	ObjectId	Client document id. oauthAccessTokens.oauthApplication_id and oauthAuthorizationCodes.oauthApplication_id point to it.	OauthApplication.mjs:5
id	String	Client id: 64 random lowercase letters and digits.	OauthApplication.mjs:7, services/web/modules/git-bridge/index.mjs:25
clientSecret	String	Client secret, written as v1. plus 32 random characters. Only getClient reads it, and nothing calls getClient (see Notes).	OauthApplication.mjs:8, git-bridge/index.mjs:26
grants	Array of String	Grant types. The git-bridge client has ['password']. Returned with the client when a token is checked (services/web/modules/oauth2-server/app/src/OAuth2Model.mjs:67-72).	OauthApplication.mjs:9, git-bridge/index.mjs:27
name	String	Client name. The git-bridge module and the personal access token code find the client by the name Overleaf Git Bridge.	OauthApplication.mjs:10, git-bridge/index.mjs:15-16,28
redirectUris	Array of String	Allowed redirect URIs. [] for the git-bridge client.	OauthApplication.mjs:11, git-bridge/index.mjs:29
scopes	Array of String	Scopes the client may use. ['git_bridge'] for the git-bridge client.	OauthApplication.mjs:12, git-bridge/index.mjs:30
pkceEnabled	Boolean	In the schema only: no code in this repo writes it, and only the unused getClient reads it (OAuth2Model.mjs:207).	OauthApplication.mjs:13

Who Writes It

Code	What it does
git-bridge/index.mjs:9-35 (module git-bridge)	When GIT_BRIDGE_ENABLED is true, creates the Overleaf Git Bridge client at web startup if no client with that name exists.

Who Reads It

Code	What it does
services/web/modules/oauth2-server/app/src/OAuthPersonalAccessTokenManager.mjs:53-61 (module oauth2-server)	Finds the Overleaf Git Bridge client by name and stores its _id in each new personal access token. Without the client no token is created.
OAuth2Model.mjs:31-39,67-72 (getAccessToken)	Loads the client of a token through oauthApplication_id and returns its id and grants.
OAuth2Model.mjs:185-209,241,275 (getClient, saveToken, saveAuthorizationCode)	Look clients up by id. Not reached in this repo, see Notes.

Indexes

Only the default _id index. The unique id_1 index comes from migrations tagged saas (20190912145016_create_oauthApplications_indexes.mjs) and server-pro (20230502180757_server_pro_oauth_indexes.mjs), which Community Edition does not run.

Notes

• Web uses @node-oauth/oauth2-server only to check bearer tokens (server.authenticate in services/web/app/src/Features/Authentication/AuthenticationController.mjs:409-450), which calls the model’s getAccessToken and verifyScope only. No route serves /oauth/token or /oauth/authorize, so getClient, saveToken and saveAuthorizationCode are never called.
• The module looks the client up by name and then creates it, and Community Edition has no unique index on name or id, so nothing stops a second client with the same name. Code that needs the client takes whichever one findOne returns.