Identity & auth
oauth_grants
What a dancer allowed an app: scopes and the profiles it may act for. One live grant per dancer + app; consenting again replaces scopes and profiles. Revoking (settings → Connected apps, or refresh-token reuse) ends every token.
Columns
| Column | Type | Null | Default | Keys |
|---|---|---|---|---|
| id | uuid | no | gen_random_uuid() | PK |
| dancer_id | uuid | no | — | |
| client_id | text | no | — | |
| scopes | jsonb | no | [] | |
| profile_ids | jsonb | no | [] | |
| revoked_at | timestamp | yes | — | |
| revoked_reason | text | yes | — | |
| last_used_at | timestamp | yes | — | |
| created_at | timestamp | no | now() | |
| updated_at | timestamp | no | now() |
Value lists come from .$type<'a' | 'b'>() in the schema — enforced in TypeScript only, not by the database.
Keys, constraints & indexes
Unique
None besides the primary key.
Indexes
- (dancer_id)oauth_grants_dancer_idx
- (client_id)oauth_grants_client_idx
Foreign keys
- dancer_id → dancers.id on delete cascade
- client_id → oauth_clients.id on delete cascade
Referenced by
- mcp_audit (grant_id)
- oauth_codes (grant_id)
- oauth_tokens (grant_id)
Used by
Code that reads or writes this table, found by static analysis of the tRPC routers and API handlers (including helpers they call).
tRPC procedures
REST & webhooks
- GET /api/architecture/admin
- ANY /mcp
- ANY /mcp/public
- ANY /oauth/revoke
- ANY /oauth/token
Relations
Rendering diagram…
Diagram source
erDiagram
dancers {
uuid id PK
text email UK
text neon_auth_id UK
text username UK
}
mcp_audit {
uuid id PK
uuid grant_id FK
uuid dancer_id FK
uuid profile_id FK
text confirm_nonce UK
}
oauth_clients {
text id PK
}
oauth_codes {
text code_hash PK
uuid grant_id FK
}
oauth_grants {
uuid id PK
uuid dancer_id FK
text client_id FK
}
oauth_tokens {
uuid id PK
uuid grant_id FK
text token_hash UK
}
oauth_grants |o--o{ mcp_audit : "grant_id"
dancers |o--o{ mcp_audit : "dancer_id"
oauth_grants ||--o{ oauth_codes : "grant_id"
dancers ||--o{ oauth_grants : "dancer_id"
oauth_clients ||--o{ oauth_grants : "client_id"
oauth_grants ||--o{ oauth_tokens : "grant_id" Defined at server/database/schema.ts:1353 as oauthGrants.