OAuth Authorization Codes Collection

oauthAuthorizationCodes is meant for the codes of the OAuth authorization code flow: one document per code, which a client swaps for an access token. The schema is services/web/app/src/models/OauthAuthorizationCode.mjs, and the oauth2-server web module has the code that would write it. In Ayakaleaf Pro nothing reaches that code, so the collection stays empty (see Notes).

Fields

Field	Type	Meaning	Source
_id	ObjectId	Document id.	OauthAuthorizationCode.mjs:6
authorizationCode	String	The code itself, stored as it is (not hashed).	OauthAuthorizationCode.mjs:8, services/web/modules/oauth2-server/app/src/OAuth2Model.mjs:280
expiresAt	Date	End of validity. getAuthorizationCode rejects a code after it, and the TTL index deletes it.	OauthAuthorizationCode.mjs:9, OAuth2Model.mjs:150-153,281
oauthApplication_id	ObjectId	Client in OAuth Applications that asked for the code.	OauthAuthorizationCode.mjs:10, OAuth2Model.mjs:275-284
redirectUri	String	Redirect URI of the request.	OauthAuthorizationCode.mjs:11, OAuth2Model.mjs:282
scope	String	Requested scope.	OauthAuthorizationCode.mjs:12, OAuth2Model.mjs:283
user_id	ObjectId	User who granted the code.	OauthAuthorizationCode.mjs:13, OAuth2Model.mjs:285
codeChallenge, codeChallengeMethod	String	PKCE challenge and its method.	OauthAuthorizationCode.mjs:14-15, OAuth2Model.mjs:286-287

Who Writes It

Code	What it does
OAuth2Model.mjs:274-300 (saveAuthorizationCode)	Inserts a code. Not reached, see Notes.
OAuth2Model.mjs:307-312 (revokeAuthorizationCode)	Deletes a code once it is used. Not reached.

Who Reads It

Code	What it does
OAuth2Model.mjs:137-177 (getAuthorizationCode)	Loads a code with its user and client. Not reached.

Indexes

Name	Keys	Options	Migration
expiresAt_1	{ expiresAt: 1 }	TTL, expireAfterSeconds: 0, partial: expiresAt exists	20230406125632_oauth_tokens_ttl.mjs

Migrations are in tools/migrations/. The unique authorizationCode_1 index comes only from migrations tagged saas and server-pro, which Community Edition does not run.

Notes

• The model methods above are called only by the authorize and token handlers of @node-oauth/oauth2-server. Web uses that library only to check bearer tokens (services/web/app/src/Features/Authentication/AuthenticationController.mjs:409-450), and no route serves /oauth/authorize or /oauth/token, so no code is ever written. Personal access tokens are created directly, see OAuth Access Tokens.