Identity & auth
oauth_tokens
Access tokens (1 h) and refresh tokens (30 d, rotating). A refresh token is spent once (`usedAt`); presenting a spent one again is reuse and revokes the whole grant.
Columns
| Column | Type | Null | Default | Keys |
|---|---|---|---|---|
| id | uuid | no | gen_random_uuid() | PK |
| grant_id | uuid | no | — | |
| kind | text accessrefresh | no | — | |
| token_hash | text | no | — | unique |
| scopes | jsonb | no | [] | |
| resource | text | no | — | |
| expires_at | timestamp | no | — | |
| used_at | timestamp | yes | — | |
| revoked_at | timestamp | yes | — | |
| created_at | timestamp | no | now() |
Value lists come from .$type<'a' | 'b'>() in the schema — enforced in TypeScript only, not by the database.
Keys, constraints & indexes
Unique
- (token_hash) oauth_tokens_token_hash_unique
Indexes
- (grant_id)oauth_tokens_grant_idx
Foreign keys
- grant_id → oauth_grants.id on delete cascade
Used by
Code that reads or writes this table, found by static analysis of the tRPC routers and API handlers (including helpers they call).
tRPC procedures
REST & webhooks
- GET /api/architecture/admin
- ANY /mcp
- ANY /mcp/public
- ANY /oauth/revoke
- ANY /oauth/token
Relations
Rendering diagram…
Diagram source
erDiagram
oauth_grants {
uuid id PK
uuid dancer_id FK
text client_id FK
}
oauth_tokens {
uuid id PK
uuid grant_id FK
text token_hash UK
}
oauth_grants ||--o{ oauth_tokens : "grant_id" Defined at server/database/schema.ts:1387 as oauthTokens.