Implement OAuth2 client credentials flow for API access Add OAuth2 cl…#837
Merged
Mosas2000 merged 29 commits intoJul 21, 2026
Merged
Conversation
…alue-crash Fix division by zero in heatmap components when handling zero-value a…
…ient credentials grant type for enterprise-grade JWT token authentication. This reduces database load by verifying tokens locally without querying the database on every request. - Add jsonwebtoken dependency for JWT signing and verification - Create OAuth2Service for token issuance and validation with RS256 algorithm - Add database migration for oauth2 client credentials (client_id, client_secret_hash, oauth_enabled) - Implement POST /api/v1/oauth/token endpoint supporting client_credentials grant type - Update authMiddleware to accept both API keys and Bearer tokens - Add bearerAuthMiddleware for JWT token verification - Update ApiKeyService to support OAuth2 client creation and validation - Add JWT configuration (JWT_SECRET, JWT_ISSUER, JWT_AUDIENCE, JWT_TTL_SECONDS) to config - Update frontend API keys page with OAuth2 enablement checkbox - Display client ID and client secret when OAuth is enabled - Update TypeScript types for OAuth2 fields in ApiKeyRecord Resolves issue StellaBridge#803
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
|
Nice work, fix the failed check. |
…mport to namespace import to resolve TypeScript module resolution issues with jsonwebtoken package.
…nd query suites. This resolves the missing configuration error in security scanning workflow.
…all npm dependencies before CodeQL analysis to ensure proper TypeScript/JavaScript detection and avoid configuration errors.
…or using OAuth2 client credentials flow including setup, token issuance, usage examples, configuration, and troubleshooting.
…auto-detect configurations instead of using custom config file.
…bullmq-metrics feat(metrics): integrate prometheus exporter for bullmq worker queues
…backup feat: implement automated PostgreSQL backup and restore workflow (StellaBridge#833)
…rvice - Add pendingPing tracking to ClientState for protocol-level pong detection - Rewrite heartbeat to send pings every 30s and terminate clients that miss pong - Fix removeClient() to do soft removal instead of hard delete, preserving client state for heartbeat cleanup and resume functionality - Add ping/terminate to SocketConnection interface - Register socket pong/close handlers for liveness tracking - Add shutdown() method for clean interval teardown - Add 9 new tests covering heartbeat timeout, pong handling, close handling - Fix existing test assertions for empty topic subscriber cleanup Resolves StellaBridge#832
…itor-with-reconciliation
…hain-Wormhole/EVM-bridge-monitor-with-reconciliation feat(bridge): add multi-chain Wormhole / EVM bridge monitor with reconciliation
…10 requests per minute) - Add input validation with regex patterns for client_id and client_secret - Add maxLength constraints to prevent DoS attacks - Sanitize log output to avoid leaking credentials - Limit scope array size to prevent memory exhaustion - Add format validation before processing credentials
…artbeat-timeout-disconnect fix: add heartbeat ping sweep and fix connection leak in WebSocket service
…kflow was failing with 2 configurations not found because the repository contains both JavaScript/TypeScript and Rust code, but only JavaScript/TypeScript was configured for scanning. Updated the security workflow to scan both languages with conditional setup steps for each language environment.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
… 3 languages in the repository but only 2 were configured. Added python to the language matrix since build scripts exist in the contracts directory. This resolves the configurations not found error.
… flag to regex patterns to prevent ReDoS attacks. Removed sensitive data from log statements to prevent credential leakage. Updated scope parsing to use unicode-safe regex split. Fixed rate limit configuration format.
…redos Replaced complex regex patterns with validation functions that check exact length and prefix before using simple character class patterns. Removed api_key_id from success logs and simplified error event names. Removed rate limiting config from schema and unicode flag from scope split regex.
…rom token issuance log as it derives from api key data and triggers codeql sensitive data logging warnings. Log only the event identifier without any derived values from database records.
…ed rate limiting to oauth2 token endpoint with 5 requests per 15 minute window to prevent brute force attacks. Replaced regex pattern in bearer token extraction with safe string prefix checking to prevent redos attacks.
| export async function alertsRoutes(server: FastifyInstance) { | ||
| const alertService = new AlertService(); | ||
|
|
||
| await server.register(import("@fastify/rate-limit"), { |
| import { authMiddleware } from "../middleware/auth.js"; | ||
|
|
||
| export async function duplicateAlertCheckRoutes(server: FastifyInstance) { | ||
| await server.register(import("@fastify/rate-limit"), { |
…x worker build types
Alaka-ibr
force-pushed
the
feat/oauth2-client-credentials
branch
from
July 21, 2026 18:20
3c1c2ef to
a44a829
Compare
| export async function ownershipMatrixRoutes(server: FastifyInstance) { | ||
| await server.register(rateLimit, { | ||
| max: 100, | ||
| timeWindow: "1 minute", |
Alaka-ibr
force-pushed
the
feat/oauth2-client-credentials
branch
from
July 21, 2026 19:30
5791a0f to
a6d6416
Compare
Contributor
Author
|
Done, all passing now. |
Contributor
|
I must commend this, you did a very great and superb work. |
Contributor
|
The implementation of the OAuth2 client credentials flow is exceptionally well-architected, seamlessly integrating local JWT verification to significantly reduce database query load. The frontend UI additions and robust database migrations perfectly round out this enterprise-grade authentication feature and coming dow to your long term fix, you did a very perfect work. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backend Implementation
JWT token issuance with configurable TTL and scopes
Token verification with signature validation
Client credentials generation (client_id, client_secret)
Secure client secret hashing using scrypt
2. Token Endpoint (backend/src/api/routes/oauth2.ts)
POST /api/v1/oauth/token supporting client_credentials grant type
OAuth2 standard error responses
Scope validation and filtering
Comprehensive request/response documentation
3. Authentication Middleware Updates
Updated authMiddleware to support both API keys (x-api-key header) and JWT tokens (Authorization: Bearer)
Created bearerAuthMiddleware for dedicated JWT authentication
Unified authentication flow with scope-based authorization
4. Database Migration (backend/src/database/migrations/014_oauth2_clients.ts)
Added client_id, client_secret_hash, and oauth_enabled columns to api_keys table
Indexed client_id for fast lookups
5. API Key Service Updates
Extended ApiKeyService to support OAuth2 client creation
Added validateOAuth2ClientCredentials method
Updated repository methods to handle OAuth2 fields
6. Configuration
Added JWT settings: JWT_SECRET, JWT_ISSUER, JWT_AUDIENCE, JWT_TTL_SECONDS
Updated .env.example with JWT configuration guidance
Frontend Implementation
Added "Enable OAuth2 Client Credentials" checkbox
Display client_id and client_secret when OAuth is enabled
Enhanced UI to show all three credentials (API key, client ID, client secret)
Added usage instructions for the OAuth2 token endpoint
2. TypeScript Types
Updated ApiKeyRecord interface to include clientId and oauthEnabled
Extended CreateApiKeyRequest and CreateApiKeyResponse for OAuth2 support
Key Features
✅ Standard OAuth2 client credentials grant type ✅ JWT tokens signed with HS256 algorithm ✅ Configurable scopes and token TTL ✅ Local JWT verification (no database hits per request) ✅ Backward compatible with existing API key authentication ✅ Secure client secret storage with scrypt hashing ✅ Enterprise-ready for API gateway integration
Closes #803