fix(auth): honor the self-hosted schema for OAuth clients

Merged
RO
2d ago
+267-9

Description

Self-hosted installations with a custom POSTGRES_DEFAULT_SCHEMA currently create OAuth client registrations in public. This fails when the migration role cannot create tables there.

Store OAuth clients in the configured application schema for single-tenant installations. Keep cloud registrations in the shared public catalog. Revision e38f8193dd32 moves existing registrations with ALTER TABLE ... SET SCHEMA, preserving client IDs, metadata, timestamps, and indexes. Update the ORM schema to match.

Correct the original migration's schema placement so fresh installations do not fail before reaching the new revision. Its downgrade accepts either historical location. Already-applied databases use the new revision to converge on the same layout. Intermediate revisions can have different layouts depending on which code version created them.

Downgrade restores the registry to public for compatibility with older application code and requires permission to create there.

How Has This Been Tested?

  • Eight PostgreSQL migration and storage tests passed, covering preserved records and indexes, upgrade/downgrade/re-upgrade, cloud and default-schema behavior, and a fresh custom-schema install without CREATE permission on public.
  • Client registration and lookup tests passed in separate processes configured for a custom schema and cloud mode.
  • Pre-commit, Ruff, and Ty checks passed.
  • Fable reviewed the migration and runtime routing. Tests exercise individual revisions rather than the complete migration chain.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

Summary by cubic

Self-hosted installations with a custom POSTGRES_DEFAULT_SCHEMA now store OAuth client registrations in that schema instead of public, fixing failures when the migration role cannot create tables there. Cloud registrations stay in the shared public catalog, and the ORM model follows the same routing.

Migration

  • Revision e38f8193dd32 moves existing self-hosted registrations to the configured schema with ALTER TABLE ... SET SCHEMA, preserving client IDs, metadata, timestamps, and indexes.
  • The original migration creates fresh installs in the configured schema, and its downgrade handles either historical location.
  • Downgrading restores the registry to public and requires permission to create there.

Summary by CodeRabbit

  • Enhancements

    • OAuth provider client registrations now use the configured database schema for self-hosted installations.
    • Existing self-hosted OAuth registrations are preserved during migration, including their IDs and metadata.
    • Cloud deployments continue storing OAuth client registrations in the shared catalog.
    • OAuth grants and tokens remain isolated by tenant.

  • Bug Fixes

    • Fresh self-hosted setups no longer require creating OAuth client tables in the public schema when a custom schema is configured.