- Ya
- 4 Septemba 2026, 02:47 UTC
- Mwandishi
- Kamo
- Ahadi ya
- ee4e60d
Until now the client id and secret for every OAuth provider came from one platform-wide registration, so an org could only connect what Kamo had registered — and a platform operator disabling a provider left every org on it with no way through at all. ORG_OAUTH_CLIENTS holds a full registration per (org, provider): the same column shape and the same PlatformSecretCipher as the platform row, so both decrypt through one path into one ResolvedOAuthClient. Resolution order is the org's own ENABLED row, then the platform row. An org that never fills one in resolves exactly as it did before, so no existing connection changes behaviour; an org that does has opted in by the act of entering credentials, which is why this needs no second "which app?" flag on every integration. Turning the org row off rather than deleting it hands that org back to Kamo's app with its credentials still on file. ResolvedOAuthClient now carries its origin, so a consumer can report which app a connection was actually made with.