Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Connected-clients UI (list authorized OAuth clients + revoke)

Open
  • Is something wrong?
#133 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Quiet
Tech stack
postgresql, react, typescript
Domain
authentication, backend, frontend

Research direction

Start with server/src/services/OAuthService.ts, the OAuth routes in server/src/api/oauth.ts or server/src/api/user.ts, and the ownership checks in middleware/resource.ts. Read the existing OAuth service and user route patterns, then inspect server/test/oauth.test.ts. Done means users can list their authorized clients and revoke a client’s access and refresh tokens, with owner checks covered by tests and a Connected apps entry in ui/src/components/navbar.tsx.

Written by the indexing model from the issue text.

Description

ai-mcp enhancement priority: medium

Optional: a navbar affordance listing the OAuth clients the user has authorized, with a revoke button (delete their oauth_token rows). Nice-to-have now that connecting is one click.

Effort: S

Migrated from ENHANCEMENTS.md (§6 AI / MCP integration).

Implementation notes

Priority: medium — Real security/self-service value (users currently cannot revoke MCP OAuth grants themselves) but low usage volume and no core-path or stability impact.

Purpose

Gives users visibility into which third-party OAuth clients (Claude Desktop, claude.ai connectors, etc.) currently hold live access to their RobocodeJs account via MCP, and a self-service way to cut that access off — closing a real gap since oauth_token rows today can only be removed by the SDK's own /revoke endpoint (which requires the client to call it, not the user).

Implementation approach
  • Server: server/src/services/OAuthService.ts — add listTokensForUser(userId) (e.g. SELECT DISTINCT clientId, kind, MAX(createdTimestamp), MAX(expiresAt) FROM oauth_token WHERE userId=$1 GROUP BY clientId, kind, then join client names via getClient/oauth_client) and deleteTokensForUserAndClient(userId, clientId) (bulk DELETE FROM oauth_token WHERE userId=$1 AND clientId=$2, covering both access+refresh rows) alongside the existing getToken/deleteToken/sweepExpired.
  • Server: new routes in server/src/api/oauth.ts (or a new oauthClients.ts mounted like user.ts) — GET /api/user/:userId/oauth-clients and DELETE /api/user/:userId/oauth-clients/:clientId, gated by auth(true) + loadUser + requireOwner (middleware/resource.ts), following the user.ts/app.ts pattern exactly.
  • UI: ui/src/components/navbar.tsx — add a "Connected apps" item under the existing user NavDropdown (next to "Sign out"), opening a small modal/page (mirror arenaRoster.tsx's show/onHide modal pattern) listing client name, scope, granted/expiry, with a revoke button calling the new DELETE endpoint.
  • No bot-facing compiler.ts surface, no simulation/SSE involvement — this is pure account-management REST + UI, isolated from the sandbox and tick loop.
Key details to plan
  • No DB migrations exist yet (#142) — new queries must use the current oauth_token/oauth_client tables as-is; no schema change needed since userId/clientId already exist per-row.
  • Revoking must delete both kind='access' and kind='refresh' rows for that user+client so a lingering refresh token can't mint a new access token post-revoke.
  • Security: this is a new authenticated, owner-scoped surface — must reuse requireOwner, not just auth(true), or one user could enumerate/revoke another's grants (same IDOR class already fixed elsewhere per the OWASP audit).
  • Testing: extend server/test/oauth.test.ts (pg-mem-backed, already mocks auth and exercises oauthService directly) with list/revoke-by-user-and-client cases; add a thin UI test if navbar/arenaRoster have existing RTL coverage.
  • Depends conceptually on #142 (migrations) only as future cleanup, not a blocker. Effort matches the issue's S label — no simulation/determinism/sandbox risk, small additive CRUD + one navbar entry; main risk is getting the ownership check right.
Dominant language
TypeScript
Stars
0
Forks
0
Avg merge
8m
Merged PRs (30d)
8

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from LeeAdcock/robocodeJs.com

All issues in LeeAdcock/robocodeJs.com

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.