ooh this is really bad. i have to engage turbo mode again… oh noes OH NO. Wasted big time making the oauth consent and own apps management frontend, fixing stuff past me got wrong or didn’t implement because i was lazy. i am still lazy. i also added a tiny amount of ui legos and fixed a stupid db brain logic error.

Right, we gotta move as my devlogs, journals, texts whatever this is, are very very long. noone will read them. they will hate it. I WILL BURN MOON TO A CRISP GODDAMIT.

My beautiful backend got a really thin coat of fixes, including a stupid error ive made. The error came from making a db constraint so a user could authorize an app only once. OKAY, but what happened? Only one user could ever authorize an app, because past me left unique constraints on the user’s id and oauth app’s id in both pending and actual authorizations. Basically i forgot to delete the single unique constraints (“int meow unique”, unique is the constraint!) while the tuple (its the “THIS COMBINATION OF THINGS MUST BE UNIQUE”, not each individual field like a normal “int meow unique”). you don’t know my confusion searching why i couldnt authorize the same app from another user lol.. i keep repeating it but GOD DAMMIT PAST ME i hope i become uhm… let’s see… a space birb hotdog nom nom with ONLY ketchup. thanks.

Ah, right CORs. ohohoho, cors. I swapped from “oauth debugger” to “oauth playground” because I.. forgot the word debugger and stumbled upon mr. oauthplayground(.io)… I DIDNT KNOW THERE WAS A BETTER THING THAN THE OAUTH DEBUGGER I USED. THIS NEW THINGY thing is a million times better AND can even test OIDC and fetch the “.well-known” oauth metadata endpoint for both modes (oauth 2.1 and oidc). good stuff.
But ofc, as always, here comes the mr. cors shinanigans. You should know that I made ALL my routes under “/v1/*” allow requests (via cors) from my frontend ONLY. Bad decision, as oauth clients need routes too, like.. i dont know.. the token endpoint that LITERALLY lets an app access whatever it asked for?… look at my paws or hands or whatever, what would be the best way to fix this? correct you deserve an star with a little uhm feather, separating the oauth part of my server into paths that the frontend will only use and paths that others will use (so no cors [heh tldr lite]). The paths the frontend touches still have cors… it makes me feel safe. also, because of the frontend cors, i couldnt redirect from the frontend consent page to the client’s backend because it was outside of the frontend origin. i had to workaorund it with a html form because I ABSOLUTELYTLITNINTATITONAIIONY REFUSED to add an entire json struct for a simple goofy response with one field named “redirect_to”.

FINNALY, the oauth frontend part finally exists!! the consent page loads the pending flow (see stupid screenshot), shows the app and the scopes in human words (minus openid, which i hide because its literally useless for the user). Then you have the typical list of your own apps to manage (see screenshot), with a create button
(yes, its a requirement). And lastly the authorized apps HAS NOW real data too with the app name, boom, last used date, boomy and human readable scopes… its very ugly as i really DONT KNOW HOW TO make it stylish hahaha.

also NEW legos for the frontend were born out of my hands for my fun, say hi to mr checkbox and the checkbox box (its a box that has a checkbox :]) plus did some cleanup on the button square style and separated the mute style. hiii guys.

anyways, this is it. i have to enable my turbo mode. i must enable or all of this was for nothing AND I WANT MY PRIZZE (even though this is clearance week… AWW MAN WHY DID I PROCASTINATE THIS HARD) >:( OR ELSE me angy with wall as always. ah, the time has come to greet you to my shitty screenshots, including one of my badly stupid drawings depicting me saying that the authorized apps collapsible is ugly: