oauth client credentials: allow to override token url at resource level (#6233)

* oauth client credentials: allow to override token url at resource level

* ee ref

backend/.sqlx/query-bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO account (workspace_id, client, expires_at, refresh_token, grant_type, cc_client_id, cc_client_secret) VALUES ($1, $2, now() + ($3 || ' seconds')::interval, $4, $5, $6, $7) RETURNING id",
+  "query": "INSERT INTO account (workspace_id, client, expires_at, refresh_token, grant_type, cc_client_id, cc_client_secret, cc_token_url) VALUES ($1, $2, now() + ($3 || ' seconds')::interval, $4, $5, $6, $7, $8) RETURNING id",
   "describe": {
     "columns": [
       {
@@ -17,6 +17,7 @@
         "Varchar",
         "Varchar",
         "Varchar",
+        "Varchar",
         "Varchar"
       ]
     },
@@ -24,5 +25,5 @@
       false
     ]
   },
-  "hash": "00418f2e621cbe7aed536cff357898f7250544dfcb3bd85d314af1058f3148d8"
+  "hash": "bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f"
 }

backend/.sqlx/query-cc269052ffc1e613d7edc31f0f7bb84f6e6301ad1afb028813105a121a69fa7e.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT client, refresh_token, grant_type, cc_client_id, cc_client_secret FROM account WHERE workspace_id = $1 AND id = $2",
+  "query": "SELECT client, refresh_token, grant_type, cc_client_id, cc_client_secret, cc_token_url FROM account WHERE workspace_id = $1 AND id = $2",
   "describe": {
     "columns": [
       {
@@ -27,6 +27,11 @@
         "ordinal": 4,
         "name": "cc_client_secret",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 5,
+        "name": "cc_token_url",
+        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -40,8 +45,9 @@
       false,
       false,
       true,
+      true,
       true
     ]
   },
-  "hash": "b9d57959f2696f74e9d24f55fb78ff9e9041ab84b896a8b980df7b550ef27a22"
+  "hash": "cc269052ffc1e613d7edc31f0f7bb84f6e6301ad1afb028813105a121a69fa7e"
 }

backend/ee-repo-ref.txt

@@ -1 +1 @@
-0a3c1d10b8936caaf76e57ea1df59c245caad268
+f07784271dc623e951171f10b08c923769d4b4d4

backend/migrations/20250718191752_token_url_oauth_override.down.sql

@@ -0,0 +1,2 @@
+-- Rollback cc_token_url column addition
+ALTER TABLE account DROP COLUMN IF EXISTS cc_token_url;

backend/migrations/20250718191752_token_url_oauth_override.up.sql

@@ -0,0 +1,3 @@
+-- Add cc_token_url column for resource-level token URL override in OAuth client credentials flow
+-- This allows resources to override the token URL from instance settings when using client credentials
+ALTER TABLE account ADD COLUMN cc_token_url VARCHAR(500);

backend/windmill-api/openapi.yaml

@@ -3413,6 +3413,9 @@ paths:
                 cc_client_secret:
                   type: string
                   description: "OAuth client secret for resource-level credentials (client_credentials flow only)"
+                cc_token_url:
+                  type: string
+                  description: "OAuth token URL override for resource-level authentication (client_credentials flow only)"
               required:
                 - expires_in
                 - client
@@ -3455,6 +3458,9 @@ paths:
                 cc_client_secret:
                   type: string
                   description: "OAuth client secret for resource-level authentication"
+                cc_token_url:
+                  type: string
+                  description: "OAuth token URL override for resource-level authentication"
               required:
                 - cc_client_id
                 - cc_client_secret

frontend/src/lib/components/AppConnectInner.svelte

@@ -116,6 +116,7 @@
 	 */
 	let clientId = $state('')
 	let clientSecret = $state('')
+	let tokenUrl = $state('')
 
 	let resourceTypeInfo: ResourceType | undefined = $state(undefined)
 
@@ -136,6 +137,7 @@
 		useClientCredentials = false
 		clientId = ''
 		clientSecret = ''
+		tokenUrl = ''
 
 		await loadConnects()
 		manual = !connects?.includes(resourceType)
@@ -346,13 +348,20 @@
 						return
 					}
 
+					const requestBody: any = {
+						scopes: scopes,
+						cc_client_id: trimmedClientId,
+						cc_client_secret: trimmedClientSecret
+					}
+
+					// Add token URL override if provided
+					if (tokenUrl.trim()) {
+						requestBody.cc_token_url = tokenUrl.trim()
+					}
+
 					const tokenResponse = await OauthService.connectClientCredentials({
 						client: resourceType,
-						requestBody: {
-							scopes: scopes,
-							cc_client_id: trimmedClientId,
-							cc_client_secret: trimmedClientSecret
-						}
+						requestBody
 					})
 
 					// Process the token response like in popup flow
@@ -430,6 +439,10 @@
 				if (useClientCredentials) {
 					accountData.cc_client_id = clientId.trim()
 					accountData.cc_client_secret = clientSecret.trim()
+					// Add token URL override if provided
+					if (tokenUrl.trim()) {
+						accountData.cc_token_url = tokenUrl.trim()
+					}
 				}
 
 				account = Number(
@@ -748,6 +761,18 @@
 									required
 								/>
 							</label>
+							<label style="display: block; margin-top: 8px;">
+								<span style="font-weight: 600;">Token URL Override (Optional)</span>
+								<input
+									type="url"
+									bind:value={tokenUrl}
+									placeholder="Custom token endpoint URL"
+									class="w-full p-2 border border-gray-300 rounded mt-1"
+								/>
+								<div style="font-size: 12px; color: #666; margin-top: 4px;">
+									Override the instance-level token URL for this resource
+								</div>
+							</label>
 						</div>
 					{/if}
 				</div>