feat(oauth): accept extra token request parameters on a registered OAuth client

.changeset/oauth-client-extra-token-params.md

@@ -0,0 +1,7 @@
+---
+"executor": patch
+---
+
+Accept extra token-request parameters on a registered OAuth client.
+
+Some providers need provider-shaped, non-secret parameters on every token request that no grant field carries — Auth0's Management API, for example, only issues a `client_credentials` token when the request names the API in `audience`. A registered (BYO) OAuth app can now carry an `audience`-style map (`tokenParams`), which executor sends on the client-credentials exchange, the authorization-code exchange, and every refresh. The map is registered through all surfaces that register a client — the web "Register OAuth app" form (new optional "Extra token parameters" JSON field), `oauth.clients.create`, and `oauth.clients.createHandoff` deep links — and is rejected if any name would shadow an OAuth protocol parameter (`grant_type`, `client_id`, `client_secret`, `scope`, `resource`, `code`, `code_verifier`, `redirect_uri`, `refresh_token`).

apps/cloud/drizzle/0023_common_the_executioner.sql

@@ -0,0 +1 @@
+ALTER TABLE "oauth_client" ADD COLUMN "token_params" json;

apps/cloud/drizzle/meta/0021_snapshot.json → apps/cloud/drizzle/meta/0023_snapshot.json

@@ -1,6 +1,6 @@
 {
-  "id": "6b0d43ca-a04b-4dc8-b637-982f7ebbc3b8",
-  "prevId": "88f2845b-be28-4ad3-92b2-2cac819478e5",
+  "id": "5b4f48bf-9d1d-4d9c-8bb0-f03d8cfef94b",
+  "prevId": "9d3bc667-63af-4a1b-99d9-b490ffcd80ef",
   "version": "7",
   "dialect": "postgresql",
   "tables": {
@@ -296,6 +296,12 @@
           "primaryKey": false,
           "notNull": false
         },
+        "v2_org_slug": {
+          "name": "v2_org_slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
         "updated_at": {
           "name": "updated_at",
           "type": "timestamp with time zone",
@@ -322,7 +328,7 @@
       "checkConstraints": {
         "org_moved_to_v2_state_check": {
           "name": "org_moved_to_v2_state_check",
-          "value": "\"org_moved_to_v2\".\"state\" in ('moving', 'moved')"
+          "value": "\"org_moved_to_v2\".\"state\" in ('moving', 'moved', 'rolled_back')"
         }
       },
       "isRLSEnabled": false
@@ -1110,6 +1116,12 @@
           "primaryKey": false,
           "notNull": false
         },
+        "token_params": {
+          "name": "token_params",
+          "type": "json",
+          "primaryKey": false,
+          "notNull": false
+        },
         "origin_kind": {
           "name": "origin_kind",
           "type": "text",

apps/cloud/drizzle/meta/_journal.json

@@ -162,6 +162,13 @@
       "when": 1792714563896,
       "tag": "0022_org_moved_to_v2_slug",
       "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "7",
+      "when": 1792999530947,
+      "tag": "0023_common_the_executioner",
+      "breakpoints": true
     }
   ]
 }

apps/cloud/src/db/executor-schema.ts

@@ -102,6 +102,9 @@ export const oauth_client = pgTable(
     credential_write: json("credential_write"),
     token_endpoint_auth_method: text("token_endpoint_auth_method"),
     resource: text("resource"),
+    // Provider-shaped, NON-secret extra parameters sent on EVERY token
+    // request this client makes. Null in rows registered without one.
+    token_params: json("token_params"),
     origin_kind: text("origin_kind"),
     origin_integration: text("origin_integration"),
     origin_issuer: text("origin_issuer"),

apps/local/drizzle/0007_fearless_lifeguard.sql

@@ -0,0 +1 @@
+ALTER TABLE `oauth_client` ADD `token_params` text;