OAuth Client — Unified ApplicationRegistration, OAuth server, and frontend (#18267)

## Summary

Consolidates three separate PRs (#18260, #18261, #18262) into a single
unified branch with all review feedback addressed:

### New features
- **ApplicationRegistration entity** — server-level registration for
OAuth apps with encrypted server variables
- **OAuth 2.0 server** — authorization code, client credentials, refresh
token grants with PKCE support
- **OAuth discovery endpoint** —
`.well-known/oauth-authorization-server` metadata
- **Frontend UI** — app registration details page with credential
management, redirect URI editing, and server variable configuration
- **CLI integration** — `twenty dev` auto-registers apps and stores
OAuth credentials locally
- **Authorize consent screen** — OAuth consent page at `/authorize`
showing requested scopes

### Review feedback addressed

**Renames (PR #18260):**
- `appRegistration` → `applicationRegistration` (entity, tables, files,
imports, GraphQL types)
- `appRegistrationVariable` → `applicationRegistrationVariable`
- `clientId` → `oAuthClientId`, `clientSecretHash` →
`oAuthClientSecretHash`, `redirectUris` → `oAuthRedirectUris`, `scopes`
→ `oAuthScopes`

**Security fixes (PR #18261):**
- Fixed redirect URI validation bypass when `oAuthRedirectUris` is an
empty array
- Fixed workspace isolation in `clientCredentialsGrant` — now uses
`find()` with explicit handling for multiple installations
- Added error logging in refresh token `catch` block instead of silently
swallowing

**Code quality (PR #18262):**
- Split `VersionDistributionEntry` into its own file (one export per
file)
- Split GraphQL queries and mutations into individual files with a
shared fragment
- Removed unused `OAuth` entry from `AuthProviderEnum`
- Added loading state to `handleRotateSecret`
- Removed 27 narration-style comments from test files
- Added proper guards (`PublicEndpointGuard`, `NoPermissionGuard`) to
controllers and resolvers

## Test plan

- [ ] Verify `twenty dev` registers an app and stores OAuth credentials
- [ ] Test OAuth authorization code flow end-to-end (authorize → token →
API call)
- [ ] Test client credentials grant
- [ ] Verify redirect URI validation rejects requests when no URIs are
registered
- [ ] Verify app registration detail page renders correctly
- [ ] Test secret rotation with loading state
- [ ] Verify server variable editing and saving
- [ ] Run `npx nx database:reset twenty-server` to validate migration

Closes #18260, #18261, #18262


Made with [Cursor](https://cursor.com)

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

packages/twenty-server/src/engine/core-modules/sso/dtos/delete-sso.dto.ts

@@ -4,8 +4,8 @@ import { Field, ObjectType } from '@nestjs/graphql';
 
 import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
 
-@ObjectType()
-export class DeleteSsoOutput {
+@ObjectType('DeleteSso')
+export class DeleteSsoDTO {
   @Field(() => UUIDScalarType)
   identityProviderId: string;
 }

packages/twenty-server/src/engine/core-modules/sso/dtos/edit-sso.dto.ts

@@ -9,8 +9,8 @@ import {
   SSOIdentityProviderStatus,
 } from 'src/engine/core-modules/sso/workspace-sso-identity-provider.entity';
 
-@ObjectType()
-export class EditSsoOutput {
+@ObjectType('EditSso')
+export class EditSsoDTO {
   @Field(() => UUIDScalarType)
   id: string;
 

packages/twenty-server/src/engine/core-modules/sso/dtos/find-available-SSO-IDP.dto.ts

@@ -18,8 +18,8 @@ class WorkspaceNameAndId {
   id: string;
 }
 
-@ObjectType()
-export class FindAvailableSSOIDPOutput {
+@ObjectType('FindAvailableSSOIDP')
+export class FindAvailableSSOIDPDTO {
   @Field(() => IdentityProviderType)
   type: SSOConfiguration['type'];
 

packages/twenty-server/src/engine/core-modules/sso/dtos/setup-sso.dto.ts

@@ -9,8 +9,8 @@ import {
   SSOIdentityProviderStatus,
 } from 'src/engine/core-modules/sso/workspace-sso-identity-provider.entity';
 
-@ObjectType()
-export class SetupSsoOutput {
+@ObjectType('SetupSso')
+export class SetupSsoDTO {
   @Field(() => UUIDScalarType)
   id: string;
 

packages/twenty-server/src/engine/core-modules/sso/sso.resolver.ts

@@ -10,15 +10,15 @@ import { EnterpriseFeaturesEnabledGuard } from 'src/engine/core-modules/auth/gua
 import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules/graphql/filters/prevent-nest-to-auto-log-graphql-errors.filter';
 import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
 import { DeleteSsoInput } from 'src/engine/core-modules/sso/dtos/delete-sso.input';
-import { DeleteSsoOutput } from 'src/engine/core-modules/sso/dtos/delete-sso.output';
+import { DeleteSsoDTO } from 'src/engine/core-modules/sso/dtos/delete-sso.dto';
 import { EditSsoInput } from 'src/engine/core-modules/sso/dtos/edit-sso.input';
-import { EditSsoOutput } from 'src/engine/core-modules/sso/dtos/edit-sso.output';
-import { FindAvailableSSOIDPOutput } from 'src/engine/core-modules/sso/dtos/find-available-SSO-IDP.output';
+import { EditSsoDTO } from 'src/engine/core-modules/sso/dtos/edit-sso.dto';
+import { FindAvailableSSOIDPDTO } from 'src/engine/core-modules/sso/dtos/find-available-SSO-IDP.dto';
 import {
   SetupOIDCSsoInput,
   SetupSAMLSsoInput,
 } from 'src/engine/core-modules/sso/dtos/setup-sso.input';
-import { SetupSsoOutput } from 'src/engine/core-modules/sso/dtos/setup-sso.output';
+import { SetupSsoDTO } from 'src/engine/core-modules/sso/dtos/setup-sso.dto';
 import { SSOService } from 'src/engine/core-modules/sso/services/sso.service';
 import { type SSOException } from 'src/engine/core-modules/sso/sso.exception';
 import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
@@ -38,11 +38,11 @@ export class SSOResolver {
   constructor(private readonly sSOService: SSOService) {}
 
   @UseGuards(WorkspaceAuthGuard, EnterpriseFeaturesEnabledGuard)
-  @Mutation(() => SetupSsoOutput)
+  @Mutation(() => SetupSsoDTO)
   async createOIDCIdentityProvider(
     @Args('input') setupSsoInput: SetupOIDCSsoInput,
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
-  ): Promise<SetupSsoOutput | SSOException> {
+  ): Promise<SetupSsoDTO | SSOException> {
     return this.sSOService.createOIDCIdentityProvider(
       setupSsoInput,
       workspaceId,
@@ -50,7 +50,7 @@ export class SSOResolver {
   }
 
   @UseGuards(WorkspaceAuthGuard, EnterpriseFeaturesEnabledGuard)
-  @Query(() => [FindAvailableSSOIDPOutput])
+  @Query(() => [FindAvailableSSOIDPDTO])
   async getSSOIdentityProviders(
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
   ) {
@@ -58,11 +58,11 @@ export class SSOResolver {
   }
 
   @UseGuards(WorkspaceAuthGuard, EnterpriseFeaturesEnabledGuard)
-  @Mutation(() => SetupSsoOutput)
+  @Mutation(() => SetupSsoDTO)
   async createSAMLIdentityProvider(
     @Args('input') setupSsoInput: SetupSAMLSsoInput,
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
-  ): Promise<SetupSsoOutput | SSOException> {
+  ): Promise<SetupSsoDTO | SSOException> {
     return this.sSOService.createSAMLIdentityProvider(
       setupSsoInput,
       workspaceId,
@@ -70,7 +70,7 @@ export class SSOResolver {
   }
 
   @UseGuards(WorkspaceAuthGuard, EnterpriseFeaturesEnabledGuard)
-  @Mutation(() => DeleteSsoOutput)
+  @Mutation(() => DeleteSsoDTO)
   async deleteSSOIdentityProvider(
     @Args('input') { identityProviderId }: DeleteSsoInput,
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -82,7 +82,7 @@ export class SSOResolver {
   }
 
   @UseGuards(WorkspaceAuthGuard, EnterpriseFeaturesEnabledGuard)
-  @Mutation(() => EditSsoOutput)
+  @Mutation(() => EditSsoDTO)
   async editSSOIdentityProvider(
     @Args('input') input: EditSsoInput,
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,