> ## Documentation Index
> Fetch the complete documentation index at: https://ayakaleaf-pro.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth Applications Collection

`oauthApplications` holds the OAuth clients that web knows. One document is one client. In Ayakaleaf Pro the only writer is the `git-bridge` web module, which creates one client named `Overleaf Git Bridge` when web starts. The schema is `services/web/app/src/models/OauthApplication.mjs`.

#### Fields

| Field | Type | Meaning | Source |
| - | - | - | - |
| `_id` | ObjectId | Client document id. `oauthAccessTokens.oauthApplication_id` and `oauthAuthorizationCodes.oauthApplication_id` point to it. | `OauthApplication.mjs:5` |
| `id` | String | Client id: 64 random lowercase letters and digits. | `OauthApplication.mjs:7`, `services/web/modules/git-bridge/index.mjs:25` |
| `clientSecret` | String | Client secret, written as `v1.` plus 32 random characters. Only `getClient` reads it, and nothing calls `getClient` (see Notes). | `OauthApplication.mjs:8`, `git-bridge/index.mjs:26` |
| `grants` | Array of String | Grant types. The git-bridge client has `['password']`. Returned with the client when a token is checked (`services/web/modules/oauth2-server/app/src/OAuth2Model.mjs:67-72`). | `OauthApplication.mjs:9`, `git-bridge/index.mjs:27` |
| `name` | String | Client name. The git-bridge module and the personal access token code find the client by the name `Overleaf Git Bridge`. | `OauthApplication.mjs:10`, `git-bridge/index.mjs:15-16,28` |
| `redirectUris` | Array of String | Allowed redirect URIs. `[]` for the git-bridge client. | `OauthApplication.mjs:11`, `git-bridge/index.mjs:29` |
| `scopes` | Array of String | Scopes the client may use. `['git_bridge']` for the git-bridge client. | `OauthApplication.mjs:12`, `git-bridge/index.mjs:30` |
| `pkceEnabled` | Boolean | In the schema only: no code in this repo writes it, and only the unused `getClient` reads it (`OAuth2Model.mjs:207`). | `OauthApplication.mjs:13` |

#### Who Writes It

| Code | What it does |
| - | - |
| `git-bridge/index.mjs:9-35` (module `git-bridge`) | When `GIT_BRIDGE_ENABLED` is `true`, creates the `Overleaf Git Bridge` client at web startup if no client with that name exists. |

#### Who Reads It

| Code | What it does |
| - | - |
| `services/web/modules/oauth2-server/app/src/OAuthPersonalAccessTokenManager.mjs:53-61` (module `oauth2-server`) | Finds the `Overleaf Git Bridge` client by name and stores its `_id` in each new personal access token. Without the client no token is created. |
| `OAuth2Model.mjs:31-39,67-72` (`getAccessToken`) | Loads the client of a token through `oauthApplication_id` and returns its `id` and `grants`. |
| `OAuth2Model.mjs:185-209,241,275` (`getClient`, `saveToken`, `saveAuthorizationCode`) | Look clients up by `id`. Not reached in this repo, see Notes. |

#### Indexes

Only the default `_id` index. The unique `id_1` index comes from migrations tagged `saas` (`20190912145016_create_oauthApplications_indexes.mjs`) and `server-pro` (`20230502180757_server_pro_oauth_indexes.mjs`), which Community Edition does not run.

#### Notes

* Web uses `@node-oauth/oauth2-server` only to check bearer tokens (`server.authenticate` in `services/web/app/src/Features/Authentication/AuthenticationController.mjs:409-450`), which calls the model's `getAccessToken` and `verifyScope` only. No route serves `/oauth/token` or `/oauth/authorize`, so `getClient`, `saveToken` and `saveAuthorizationCode` are never called.
* The module looks the client up by name and then creates it, and Community Edition has no unique index on `name` or `id`, so nothing stops a second client with the same name. Code that needs the client takes whichever one `findOne` returns.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.