5 Commits

Include renames

Author	SHA1	Message	Date
Kristoffer Dalby	bba7252ec5	db: keep at most 1000 access tokens per OAuth client ... Minting needs only the client secret, whatever its scopes, and added one row per mint. Each mint now ends tokens past the newest 1000.	2026-10-28 18:28:23 +00:00
Kristoffer Dalby	393dd3e2d9	db: store all credentials in one SHA-256-hashed table ... API keys, pre-auth keys and OAuth clients/tokens share one table and verify path. Secrets carry 256 bits of crypto/rand entropy, so a SHA-256 digest needs no stretching; bcrypt/argon2id rows rehash on use until 0.32.	2026-09-26 00:33:12 +02:00
MsfPablo	d60bac5c79	db: reject unknown OAuth client scopes at creation (#3424) ... Unknown scopes grant nothing, so clients were silently under-privileged. Report every invalid scope at once. Fixes #3406	2026-09-25 21:24:37 +02:00
Kristoffer Dalby	69e84c356d	db: accept tskey-client- prefix for OAuth client auth ... The upstream tailscale client only runs its OAuth client-credentials exchange for secrets prefixed tskey-client-, so accept it as an alias for hskey-client-. The prefix is only a label sliced off before lookup, so the same stored client authenticates under either; lets the official client and GitHub Action mint auth keys against headscale.	2026-09-25 17:09:19 +02:00
Kristoffer Dalby	ee95cf58d9	hscontrol: add the OAuth client and access-token model ... Add the OAuth client type, its database storage, the scope grant package, policy tag-ownership exposure, and the state operations backing the v2 OAuth client-credentials flow.	2026-06-26 09:18:06 +02:00