feat: add OAuth2 applications (#11197)

* Add database tables for OAuth2 applications These are applications that will be able to use OAuth2 to get an API key from Coder. * Add endpoints for managing OAuth2 applications These let you add, update, and remove OAuth2 applications. * Add frontend for managing OAuth2 applications
2025-07-13 21:36:50 +00:00 · 2023-12-21 12:38:42 -09:00
parent e044d3b752
commit 5cfa34b31e
47 changed files with 4281 additions and 1 deletions
--- a/enterprise/coderd/coderd.go
+++ b/enterprise/coderd/coderd.go
@ -311,6 +311,33 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 			r.Get("/", api.userQuietHoursSchedule)
 			r.Put("/", api.putUserQuietHoursSchedule)
 		})
+		r.Route("/oauth2-provider", func(r chi.Router) {
+			r.Use(
+				apiKeyMiddleware,
+				api.oAuth2ProviderMiddleware,
+			)
+			r.Route("/apps", func(r chi.Router) {
+				r.Get("/", api.oAuth2ProviderApps)
+				r.Post("/", api.postOAuth2ProviderApp)
+
+				r.Route("/{app}", func(r chi.Router) {
+					r.Use(httpmw.ExtractOAuth2ProviderApp(options.Database))
+					r.Get("/", api.oAuth2ProviderApp)
+					r.Put("/", api.putOAuth2ProviderApp)
+					r.Delete("/", api.deleteOAuth2ProviderApp)
+
+					r.Route("/secrets", func(r chi.Router) {
+						r.Get("/", api.oAuth2ProviderAppSecrets)
+						r.Post("/", api.postOAuth2ProviderAppSecret)
+
+						r.Route("/{secretID}", func(r chi.Router) {
+							r.Use(httpmw.ExtractOAuth2ProviderAppSecret(options.Database))
+							r.Delete("/", api.deleteOAuth2ProviderAppSecret)
+						})
+					})
+				})
+			})
+		})
 	})

 	if len(options.SCIMAPIKey) != 0 {
@ -487,6 +514,7 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 			codersdk.FeatureBrowserOnly:                api.BrowserOnly,
 			codersdk.FeatureSCIM:                       len(api.SCIMAPIKey) != 0,
 			codersdk.FeatureMultipleExternalAuth:       len(api.ExternalAuthConfigs) > 1,
+			codersdk.FeatureOAuth2Provider:             true,
 			codersdk.FeatureTemplateRBAC:               api.RBAC,
 			codersdk.FeatureExternalTokenEncryption:    len(api.ExternalTokenEncryption) > 0,
 			codersdk.FeatureExternalProvisionerDaemons: true,
--- a/enterprise/coderd/oauth2.go
+++ b/enterprise/coderd/oauth2.go
@ -0,0 +1,255 @@
+package coderd
+
+import (
+	"crypto/sha256"
+	"net/http"
+
+	"github.com/google/uuid"
+
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+)
+
+func (api *API) oAuth2ProviderMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		if !buildinfo.IsDev() {
+			httpapi.Write(r.Context(), rw, http.StatusForbidden, codersdk.Response{
+				Message: "OAuth2 provider is under development.",
+			})
+			return
+		}
+
+		api.entitlementsMu.RLock()
+		entitled := api.entitlements.Features[codersdk.FeatureOAuth2Provider].Entitlement != codersdk.EntitlementNotEntitled
+		api.entitlementsMu.RUnlock()
+
+		if !entitled {
+			httpapi.Write(r.Context(), rw, http.StatusForbidden, codersdk.Response{
+				Message: "OAuth2 provider is an Enterprise feature. Contact sales!",
+			})
+			return
+		}
+
+		next.ServeHTTP(rw, r)
+	})
+}
+
+// @Summary Get OAuth2 applications.
+// @ID get-oauth2-applications
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Enterprise
+// @Success 200 {array} codersdk.OAuth2ProviderApp
+// @Router /oauth2-provider/apps [get]
+func (api *API) oAuth2ProviderApps(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	dbApps, err := api.Database.GetOAuth2ProviderApps(ctx)
+	if err != nil {
+		httpapi.InternalServerError(rw, err)
+		return
+	}
+	httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApps(dbApps))
+}
+
+// @Summary Get OAuth2 application.
+// @ID get-oauth2-application
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Enterprise
+// @Param app path string true "App ID"
+// @Success 200 {object} codersdk.OAuth2ProviderApp
+// @Router /oauth2-provider/apps/{app} [get]
+func (*API) oAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	app := httpmw.OAuth2ProviderApp(r)
+	httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(app))
+}
+
+// @Summary Create OAuth2 application.
+// @ID create-oauth2-application
+// @Security CoderSessionToken
+// @Accept json
+// @Produce json
+// @Tags Enterprise
+// @Param request body codersdk.PostOAuth2ProviderAppRequest true "The OAuth2 application to create."
+// @Success 200 {object} codersdk.OAuth2ProviderApp
+// @Router /oauth2-provider/apps [post]
+func (api *API) postOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	var req codersdk.PostOAuth2ProviderAppRequest
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+	app, err := api.Database.InsertOAuth2ProviderApp(ctx, database.InsertOAuth2ProviderAppParams{
+		ID:          uuid.New(),
+		CreatedAt:   dbtime.Now(),
+		UpdatedAt:   dbtime.Now(),
+		Name:        req.Name,
+		Icon:        req.Icon,
+		CallbackURL: req.CallbackURL,
+	})
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error creating OAuth2 application.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	httpapi.Write(ctx, rw, http.StatusCreated, db2sdk.OAuth2ProviderApp(app))
+}
+
+// @Summary Update OAuth2 application.
+// @ID update-oauth2-application
+// @Security CoderSessionToken
+// @Accept json
+// @Produce json
+// @Tags Enterprise
+// @Param app path string true "App ID"
+// @Param request body codersdk.PutOAuth2ProviderAppRequest true "Update an OAuth2 application."
+// @Success 200 {object} codersdk.OAuth2ProviderApp
+// @Router /oauth2-provider/apps/{app} [put]
+func (api *API) putOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	app := httpmw.OAuth2ProviderApp(r)
+	var req codersdk.PutOAuth2ProviderAppRequest
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+	app, err := api.Database.UpdateOAuth2ProviderAppByID(ctx, database.UpdateOAuth2ProviderAppByIDParams{
+		ID:          app.ID,
+		UpdatedAt:   dbtime.Now(),
+		Name:        req.Name,
+		Icon:        req.Icon,
+		CallbackURL: req.CallbackURL,
+	})
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error creating OAuth2 application.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(app))
+}
+
+// @Summary Delete OAuth2 application.
+// @ID delete-oauth2-application
+// @Security CoderSessionToken
+// @Tags Enterprise
+// @Param app path string true "App ID"
+// @Success 204
+// @Router /oauth2-provider/apps/{app} [delete]
+func (api *API) deleteOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	app := httpmw.OAuth2ProviderApp(r)
+	err := api.Database.DeleteOAuth2ProviderAppByID(ctx, app.ID)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error deleting OAuth2 application.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	httpapi.Write(ctx, rw, http.StatusNoContent, nil)
+}
+
+// @Summary Get OAuth2 application secrets.
+// @ID get-oauth2-application-secrets
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Enterprise
+// @Param app path string true "App ID"
+// @Success 200 {array} codersdk.OAuth2ProviderAppSecret
+// @Router /oauth2-provider/apps/{app}/secrets [get]
+func (api *API) oAuth2ProviderAppSecrets(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	app := httpmw.OAuth2ProviderApp(r)
+	dbSecrets, err := api.Database.GetOAuth2ProviderAppSecretsByAppID(ctx, app.ID)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error getting OAuth2 client secrets.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	secrets := []codersdk.OAuth2ProviderAppSecret{}
+	for _, secret := range dbSecrets {
+		secrets = append(secrets, codersdk.OAuth2ProviderAppSecret{
+			ID:                    secret.ID,
+			LastUsedAt:            codersdk.NullTime{NullTime: secret.LastUsedAt},
+			ClientSecretTruncated: secret.DisplaySecret,
+		})
+	}
+	httpapi.Write(ctx, rw, http.StatusOK, secrets)
+}
+
+// @Summary Create OAuth2 application secret.
+// @ID create-oauth2-application-secret
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Enterprise
+// @Param app path string true "App ID"
+// @Success 200 {array} codersdk.OAuth2ProviderAppSecretFull
+// @Router /oauth2-provider/apps/{app}/secrets [post]
+func (api *API) postOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	app := httpmw.OAuth2ProviderApp(r)
+	// 40 characters matches the length of GitHub's client secrets.
+	rawSecret, err := cryptorand.String(40)
+	if err != nil {
+		httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to generate OAuth2 client secret.",
+		})
+		return
+	}
+	hashed := sha256.Sum256([]byte(rawSecret))
+	secret, err := api.Database.InsertOAuth2ProviderAppSecret(ctx, database.InsertOAuth2ProviderAppSecretParams{
+		ID:           uuid.New(),
+		CreatedAt:    dbtime.Now(),
+		HashedSecret: hashed[:],
+		// DisplaySecret is the last six characters of the original unhashed secret.
+		// This is done so they can be differentiated and it matches how GitHub
+		// displays their client secrets.
+		DisplaySecret: rawSecret[len(rawSecret)-6:],
+		AppID:         app.ID,
+	})
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error creating OAuth2 client secret.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	httpapi.Write(ctx, rw, http.StatusOK, codersdk.OAuth2ProviderAppSecretFull{
+		ID:               secret.ID,
+		ClientSecretFull: rawSecret,
+	})
+}
+
+// @Summary Delete OAuth2 application secret.
+// @ID delete-oauth2-application-secret
+// @Security CoderSessionToken
+// @Tags Enterprise
+// @Param app path string true "App ID"
+// @Param secretID path string true "Secret ID"
+// @Success 204
+// @Router /oauth2-provider/apps/{app}/secrets/{secretID} [delete]
+func (api *API) deleteOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	secret := httpmw.OAuth2ProviderAppSecret(r)
+	err := api.Database.DeleteOAuth2ProviderAppSecretByID(ctx, secret.ID)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error deleting OAuth2 client secret.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	httpapi.Write(ctx, rw, http.StatusNoContent, nil)
+}
--- a/enterprise/coderd/oauth2_test.go
+++ b/enterprise/coderd/oauth2_test.go
@ -0,0 +1,367 @@
+package coderd_test
+
+import (
+	"strconv"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestOAuthApps(t *testing.T) {
+	t.Parallel()
+
+	t.Run("Validation", func(t *testing.T) {
+		t.Parallel()
+
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureOAuth2Provider: 1,
+			},
+		}})
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		tests := []struct {
+			name string
+			req  codersdk.PostOAuth2ProviderAppRequest
+		}{
+			{
+				name: "NameMissing",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					CallbackURL: "http://localhost:3000",
+				},
+			},
+			{
+				name: "NameSpaces",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo bar",
+					CallbackURL: "http://localhost:3000",
+				},
+			},
+			{
+				name: "NameTooLong",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "too loooooooooooooooooooooooooong",
+					CallbackURL: "http://localhost:3000",
+				},
+			},
+			{
+				name: "NameTaken",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "taken",
+					CallbackURL: "http://localhost:3000",
+				},
+			},
+			{
+				name: "URLMissing",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name: "foo",
+				},
+			},
+			{
+				name: "URLLocalhostNoScheme",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "localhost:3000",
+				},
+			},
+			{
+				name: "URLNoScheme",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "coder.com",
+				},
+			},
+			{
+				name: "URLNoColon",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "http//coder",
+				},
+			},
+			{
+				name: "URLJustBar",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "bar",
+				},
+			},
+			{
+				name: "URLPathOnly",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "/bar/baz/qux",
+				},
+			},
+			{
+				name: "URLJustHttp",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "http",
+				},
+			},
+			{
+				name: "URLNoHost",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "http://",
+				},
+			},
+			{
+				name: "URLSpaces",
+				req: codersdk.PostOAuth2ProviderAppRequest{
+					Name:        "foo",
+					CallbackURL: "bar baz qux",
+				},
+			},
+		}
+
+		// Generate an application for testing name conflicts.
+		req := codersdk.PostOAuth2ProviderAppRequest{
+			Name:        "taken",
+			CallbackURL: "http://coder.com",
+		}
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		_, err := client.PostOAuth2ProviderApp(ctx, req)
+		require.NoError(t, err)
+
+		// Generate an application for testing PUTs.
+		req = codersdk.PostOAuth2ProviderAppRequest{
+			Name:        "quark",
+			CallbackURL: "http://coder.com",
+		}
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		existingApp, err := client.PostOAuth2ProviderApp(ctx, req)
+		require.NoError(t, err)
+
+		for _, test := range tests {
+			test := test
+			t.Run(test.name, func(t *testing.T) {
+				t.Parallel()
+
+				//nolint:gocritic // OAauth2 app management requires owner permission.
+				_, err := client.PostOAuth2ProviderApp(ctx, test.req)
+				require.Error(t, err)
+
+				//nolint:gocritic // OAauth2 app management requires owner permission.
+				_, err = client.PutOAuth2ProviderApp(ctx, existingApp.ID, codersdk.PutOAuth2ProviderAppRequest{
+					Name:        test.req.Name,
+					CallbackURL: test.req.CallbackURL,
+				})
+				require.Error(t, err)
+			})
+		}
+	})
+
+	t.Run("DeleteNonExisting", func(t *testing.T) {
+		t.Parallel()
+
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureOAuth2Provider: 1,
+			},
+		}})
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		_, err := client.OAuth2ProviderApp(ctx, uuid.New())
+		require.Error(t, err)
+	})
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureOAuth2Provider: 1,
+			},
+		}})
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		// No apps yet.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		apps, err := client.OAuth2ProviderApps(ctx)
+		require.NoError(t, err)
+		require.Len(t, apps, 0)
+
+		// Should be able to add apps.
+		expected := []codersdk.OAuth2ProviderApp{}
+		for i := 0; i < 5; i++ {
+			postReq := codersdk.PostOAuth2ProviderAppRequest{
+				Name:        "foo-" + strconv.Itoa(i),
+				CallbackURL: "http://" + strconv.Itoa(i) + ".localhost:3000",
+			}
+			//nolint:gocritic // OAauth2 app management requires owner permission.
+			app, err := client.PostOAuth2ProviderApp(ctx, postReq)
+			require.NoError(t, err)
+			require.Equal(t, postReq.Name, app.Name)
+			require.Equal(t, postReq.CallbackURL, app.CallbackURL)
+			expected = append(expected, app)
+		}
+
+		// Should get all the apps now.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		apps, err = client.OAuth2ProviderApps(ctx)
+		require.NoError(t, err)
+		require.Len(t, apps, 5)
+		require.Equal(t, expected, apps)
+
+		// Should be able to keep the same name when updating.
+		req := codersdk.PutOAuth2ProviderAppRequest{
+			Name:        expected[0].Name,
+			CallbackURL: "http://coder.com",
+			Icon:        "test",
+		}
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		newApp, err := client.PutOAuth2ProviderApp(ctx, expected[0].ID, req)
+		require.NoError(t, err)
+		require.Equal(t, req.Name, newApp.Name)
+		require.Equal(t, req.CallbackURL, newApp.CallbackURL)
+		require.Equal(t, req.Icon, newApp.Icon)
+		require.Equal(t, expected[0].ID, newApp.ID)
+
+		// Should be able to update name.
+		req = codersdk.PutOAuth2ProviderAppRequest{
+			Name:        "new-foo",
+			CallbackURL: "http://coder.com",
+			Icon:        "test",
+		}
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		newApp, err = client.PutOAuth2ProviderApp(ctx, expected[0].ID, req)
+		require.NoError(t, err)
+		require.Equal(t, req.Name, newApp.Name)
+		require.Equal(t, req.CallbackURL, newApp.CallbackURL)
+		require.Equal(t, req.Icon, newApp.Icon)
+		require.Equal(t, expected[0].ID, newApp.ID)
+
+		// Should be able to get a single app.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		got, err := client.OAuth2ProviderApp(ctx, expected[0].ID)
+		require.NoError(t, err)
+		require.Equal(t, newApp, got)
+
+		// Should be able to delete an app.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		err = client.DeleteOAuth2ProviderApp(ctx, expected[0].ID)
+		require.NoError(t, err)
+
+		// Should show the new count.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		newApps, err := client.OAuth2ProviderApps(ctx)
+		require.NoError(t, err)
+		require.Len(t, newApps, 4)
+		require.Equal(t, expected[1:], newApps)
+	})
+}
+
+func TestOAuthAppSecrets(t *testing.T) {
+	t.Parallel()
+
+	client, _ := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+		Features: license.Features{
+			codersdk.FeatureOAuth2Provider: 1,
+		},
+	}})
+
+	ctx := testutil.Context(t, testutil.WaitLong)
+
+	// Make some apps.
+	//nolint:gocritic // OAauth2 app management requires owner permission.
+	app1, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+		Name:        "razzle-dazzle",
+		CallbackURL: "http://localhost",
+	})
+	require.NoError(t, err)
+
+	//nolint:gocritic // OAauth2 app management requires owner permission.
+	app2, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+		Name:        "razzle-dazzle-the-sequel",
+		CallbackURL: "http://localhost",
+	})
+	require.NoError(t, err)
+
+	t.Run("DeleteNonExisting", func(t *testing.T) {
+		t.Parallel()
+
+		// Should not be able to create secrets for a non-existent app.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		_, err = client.OAuth2ProviderAppSecrets(ctx, uuid.New())
+		require.Error(t, err)
+
+		// Should not be able to delete non-existing secrets when there is no app.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		err = client.DeleteOAuth2ProviderAppSecret(ctx, uuid.New(), uuid.New())
+		require.Error(t, err)
+
+		// Should not be able to delete non-existing secrets when the app exists.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		err = client.DeleteOAuth2ProviderAppSecret(ctx, app1.ID, uuid.New())
+		require.Error(t, err)
+
+		// Should not be able to delete an existing secret with the wrong app ID.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		secret, err := client.PostOAuth2ProviderAppSecret(ctx, app2.ID)
+		require.NoError(t, err)
+
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		err = client.DeleteOAuth2ProviderAppSecret(ctx, app1.ID, secret.ID)
+		require.Error(t, err)
+	})
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+
+		// No secrets yet.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		secrets, err := client.OAuth2ProviderAppSecrets(ctx, app1.ID)
+		require.NoError(t, err)
+		require.Len(t, secrets, 0)
+
+		// Should be able to create secrets.
+		for i := 0; i < 5; i++ {
+			//nolint:gocritic // OAauth2 app management requires owner permission.
+			secret, err := client.PostOAuth2ProviderAppSecret(ctx, app1.ID)
+			require.NoError(t, err)
+			require.NotEmpty(t, secret.ClientSecretFull)
+			require.True(t, len(secret.ClientSecretFull) > 6)
+
+			//nolint:gocritic // OAauth2 app management requires owner permission.
+			_, err = client.PostOAuth2ProviderAppSecret(ctx, app2.ID)
+			require.NoError(t, err)
+		}
+
+		// Should get secrets now, but only for the one app.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		secrets, err = client.OAuth2ProviderAppSecrets(ctx, app1.ID)
+		require.NoError(t, err)
+		require.Len(t, secrets, 5)
+		for _, secret := range secrets {
+			require.Len(t, secret.ClientSecretTruncated, 6)
+		}
+
+		// Should be able to delete a secret.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		err = client.DeleteOAuth2ProviderAppSecret(ctx, app1.ID, secrets[0].ID)
+		require.NoError(t, err)
+		secrets, err = client.OAuth2ProviderAppSecrets(ctx, app1.ID)
+		require.NoError(t, err)
+		require.Len(t, secrets, 4)
+
+		// No secrets once the app is deleted.
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		err = client.DeleteOAuth2ProviderApp(ctx, app1.ID)
+		require.NoError(t, err)
+
+		//nolint:gocritic // OAauth2 app management requires owner permission.
+		_, err = client.OAuth2ProviderAppSecrets(ctx, app1.ID)
+		require.Error(t, err)
+	})
+}