From 506e17864ebe3e877d77790bade69097b88bd31b Mon Sep 17 00:00:00 2001 From: Alexander Petric Date: Mon, 21 Jul 2025 16:08:56 -0400 Subject: [PATCH] oauth client credentials: allow to override token url at resource level (#6233) * oauth client credentials: allow to override token url at resource level * ee ref --- ...966282fe6543e0eb957fc10864dbf58de58f.json} | 5 +-- ...b84f6e6301ad1afb028813105a121a69fa7e.json} | 10 ++++-- backend/ee-repo-ref.txt | 2 +- ...18191752_token_url_oauth_override.down.sql | 2 ++ ...0718191752_token_url_oauth_override.up.sql | 3 ++ backend/windmill-api/openapi.yaml | 6 ++++ .../src/lib/components/AppConnectInner.svelte | 35 ++++++++++++++++--- 7 files changed, 53 insertions(+), 10 deletions(-) rename backend/.sqlx/{query-00418f2e621cbe7aed536cff357898f7250544dfcb3bd85d314af1058f3148d8.json => query-bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f.json} (62%) rename backend/.sqlx/{query-b9d57959f2696f74e9d24f55fb78ff9e9041ab84b896a8b980df7b550ef27a22.json => query-cc269052ffc1e613d7edc31f0f7bb84f6e6301ad1afb028813105a121a69fa7e.json} (74%) create mode 100644 backend/migrations/20250718191752_token_url_oauth_override.down.sql create mode 100644 backend/migrations/20250718191752_token_url_oauth_override.up.sql diff --git a/backend/.sqlx/query-00418f2e621cbe7aed536cff357898f7250544dfcb3bd85d314af1058f3148d8.json b/backend/.sqlx/query-bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f.json similarity index 62% rename from backend/.sqlx/query-00418f2e621cbe7aed536cff357898f7250544dfcb3bd85d314af1058f3148d8.json rename to backend/.sqlx/query-bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f.json index b59c2e80e5..e3f60d4a5c 100644 --- a/backend/.sqlx/query-00418f2e621cbe7aed536cff357898f7250544dfcb3bd85d314af1058f3148d8.json +++ b/backend/.sqlx/query-bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "INSERT INTO account (workspace_id, client, expires_at, refresh_token, grant_type, cc_client_id, cc_client_secret) VALUES ($1, $2, now() + ($3 || ' seconds')::interval, $4, $5, $6, $7) RETURNING id", + "query": "INSERT INTO account (workspace_id, client, expires_at, refresh_token, grant_type, cc_client_id, cc_client_secret, cc_token_url) VALUES ($1, $2, now() + ($3 || ' seconds')::interval, $4, $5, $6, $7, $8) RETURNING id", "describe": { "columns": [ { @@ -17,6 +17,7 @@ "Varchar", "Varchar", "Varchar", + "Varchar", "Varchar" ] }, @@ -24,5 +25,5 @@ false ] }, - "hash": "00418f2e621cbe7aed536cff357898f7250544dfcb3bd85d314af1058f3148d8" + "hash": "bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f" } diff --git a/backend/.sqlx/query-b9d57959f2696f74e9d24f55fb78ff9e9041ab84b896a8b980df7b550ef27a22.json b/backend/.sqlx/query-cc269052ffc1e613d7edc31f0f7bb84f6e6301ad1afb028813105a121a69fa7e.json similarity index 74% rename from backend/.sqlx/query-b9d57959f2696f74e9d24f55fb78ff9e9041ab84b896a8b980df7b550ef27a22.json rename to backend/.sqlx/query-cc269052ffc1e613d7edc31f0f7bb84f6e6301ad1afb028813105a121a69fa7e.json index 02f737b21c..2354b265a8 100644 --- a/backend/.sqlx/query-b9d57959f2696f74e9d24f55fb78ff9e9041ab84b896a8b980df7b550ef27a22.json +++ b/backend/.sqlx/query-cc269052ffc1e613d7edc31f0f7bb84f6e6301ad1afb028813105a121a69fa7e.json @@ -1,6 +1,6 @@ { "db_name": "PostgreSQL", - "query": "SELECT client, refresh_token, grant_type, cc_client_id, cc_client_secret FROM account WHERE workspace_id = $1 AND id = $2", + "query": "SELECT client, refresh_token, grant_type, cc_client_id, cc_client_secret, cc_token_url FROM account WHERE workspace_id = $1 AND id = $2", "describe": { "columns": [ { @@ -27,6 +27,11 @@ "ordinal": 4, "name": "cc_client_secret", "type_info": "Varchar" + }, + { + "ordinal": 5, + "name": "cc_token_url", + "type_info": "Varchar" } ], "parameters": { @@ -40,8 +45,9 @@ false, false, true, + true, true ] }, - "hash": "b9d57959f2696f74e9d24f55fb78ff9e9041ab84b896a8b980df7b550ef27a22" + "hash": "cc269052ffc1e613d7edc31f0f7bb84f6e6301ad1afb028813105a121a69fa7e" } diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt index 671105ff69..00c8342578 100644 --- a/backend/ee-repo-ref.txt +++ b/backend/ee-repo-ref.txt @@ -1 +1 @@ -0a3c1d10b8936caaf76e57ea1df59c245caad268 \ No newline at end of file +f07784271dc623e951171f10b08c923769d4b4d4 \ No newline at end of file diff --git a/backend/migrations/20250718191752_token_url_oauth_override.down.sql b/backend/migrations/20250718191752_token_url_oauth_override.down.sql new file mode 100644 index 0000000000..863be1262e --- /dev/null +++ b/backend/migrations/20250718191752_token_url_oauth_override.down.sql @@ -0,0 +1,2 @@ +-- Rollback cc_token_url column addition +ALTER TABLE account DROP COLUMN IF EXISTS cc_token_url; diff --git a/backend/migrations/20250718191752_token_url_oauth_override.up.sql b/backend/migrations/20250718191752_token_url_oauth_override.up.sql new file mode 100644 index 0000000000..ffbcddf58e --- /dev/null +++ b/backend/migrations/20250718191752_token_url_oauth_override.up.sql @@ -0,0 +1,3 @@ +-- Add cc_token_url column for resource-level token URL override in OAuth client credentials flow +-- This allows resources to override the token URL from instance settings when using client credentials +ALTER TABLE account ADD COLUMN cc_token_url VARCHAR(500); diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml index 4a0f3a7db7..c050497961 100644 --- a/backend/windmill-api/openapi.yaml +++ b/backend/windmill-api/openapi.yaml @@ -3413,6 +3413,9 @@ paths: cc_client_secret: type: string description: "OAuth client secret for resource-level credentials (client_credentials flow only)" + cc_token_url: + type: string + description: "OAuth token URL override for resource-level authentication (client_credentials flow only)" required: - expires_in - client @@ -3455,6 +3458,9 @@ paths: cc_client_secret: type: string description: "OAuth client secret for resource-level authentication" + cc_token_url: + type: string + description: "OAuth token URL override for resource-level authentication" required: - cc_client_id - cc_client_secret diff --git a/frontend/src/lib/components/AppConnectInner.svelte b/frontend/src/lib/components/AppConnectInner.svelte index 47948fc6fb..2ad4047d22 100644 --- a/frontend/src/lib/components/AppConnectInner.svelte +++ b/frontend/src/lib/components/AppConnectInner.svelte @@ -116,6 +116,7 @@ */ let clientId = $state('') let clientSecret = $state('') + let tokenUrl = $state('') let resourceTypeInfo: ResourceType | undefined = $state(undefined) @@ -136,6 +137,7 @@ useClientCredentials = false clientId = '' clientSecret = '' + tokenUrl = '' await loadConnects() manual = !connects?.includes(resourceType) @@ -346,13 +348,20 @@ return } + const requestBody: any = { + scopes: scopes, + cc_client_id: trimmedClientId, + cc_client_secret: trimmedClientSecret + } + + // Add token URL override if provided + if (tokenUrl.trim()) { + requestBody.cc_token_url = tokenUrl.trim() + } + const tokenResponse = await OauthService.connectClientCredentials({ client: resourceType, - requestBody: { - scopes: scopes, - cc_client_id: trimmedClientId, - cc_client_secret: trimmedClientSecret - } + requestBody }) // Process the token response like in popup flow @@ -430,6 +439,10 @@ if (useClientCredentials) { accountData.cc_client_id = clientId.trim() accountData.cc_client_secret = clientSecret.trim() + // Add token URL override if provided + if (tokenUrl.trim()) { + accountData.cc_token_url = tokenUrl.trim() + } } account = Number( @@ -748,6 +761,18 @@ required /> + {/if}