OAuth Client — Unified ApplicationRegistration, OAuth server, and frontend (#18267)

## Summary

Consolidates three separate PRs (#18260, #18261, #18262) into a single
unified branch with all review feedback addressed:

### New features
- **ApplicationRegistration entity** — server-level registration for
OAuth apps with encrypted server variables
- **OAuth 2.0 server** — authorization code, client credentials, refresh
token grants with PKCE support
- **OAuth discovery endpoint** —
`.well-known/oauth-authorization-server` metadata
- **Frontend UI** — app registration details page with credential
management, redirect URI editing, and server variable configuration
- **CLI integration** — `twenty dev` auto-registers apps and stores
OAuth credentials locally
- **Authorize consent screen** — OAuth consent page at `/authorize`
showing requested scopes

### Review feedback addressed

**Renames (PR #18260):**
- `appRegistration` → `applicationRegistration` (entity, tables, files,
imports, GraphQL types)
- `appRegistrationVariable` → `applicationRegistrationVariable`
- `clientId` → `oAuthClientId`, `clientSecretHash` →
`oAuthClientSecretHash`, `redirectUris` → `oAuthRedirectUris`, `scopes`
→ `oAuthScopes`

**Security fixes (PR #18261):**
- Fixed redirect URI validation bypass when `oAuthRedirectUris` is an
empty array
- Fixed workspace isolation in `clientCredentialsGrant` — now uses
`find()` with explicit handling for multiple installations
- Added error logging in refresh token `catch` block instead of silently
swallowing

**Code quality (PR #18262):**
- Split `VersionDistributionEntry` into its own file (one export per
file)
- Split GraphQL queries and mutations into individual files with a
shared fragment
- Removed unused `OAuth` entry from `AuthProviderEnum`
- Added loading state to `handleRotateSecret`
- Removed 27 narration-style comments from test files
- Added proper guards (`PublicEndpointGuard`, `NoPermissionGuard`) to
controllers and resolvers

## Test plan

- [ ] Verify `twenty dev` registers an app and stores OAuth credentials
- [ ] Test OAuth authorization code flow end-to-end (authorize → token →
API call)
- [ ] Test client credentials grant
- [ ] Verify redirect URI validation rejects requests when no URIs are
registered
- [ ] Verify app registration detail page renders correctly
- [ ] Test secret rotation with loading state
- [ ] Verify server variable editing and saving
- [ ] Run `npx nx database:reset twenty-server` to validate migration

Closes #18260, #18261, #18262


Made with [Cursor](https://cursor.com)

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

packages/twenty-server/src/modules/dashboard/chart-data/services/bar-chart-data.service.ts

@@ -19,7 +19,7 @@ import { GraphOrderBy } from 'src/engine/metadata-modules/page-layout-widget/enu
 import { BAR_CHART_MAXIMUM_NUMBER_OF_BARS } from 'src/modules/dashboard/chart-data/constants/bar-chart-maximum-number-of-bars.constant';
 import { BAR_CHART_MAXIMUM_NUMBER_OF_GROUPS_PER_BAR } from 'src/modules/dashboard/chart-data/constants/bar-chart-maximum-number-of-groups-per-bar.constant';
 import { EXTRA_ITEM_TO_DETECT_TOO_MANY_GROUPS } from 'src/modules/dashboard/chart-data/constants/extra-item-to-detect-too-many-groups.constant';
-import { BarChartDataOutputDTO } from 'src/modules/dashboard/chart-data/dtos/outputs/bar-chart-data-output.dto';
+import { BarChartDataDTO } from 'src/modules/dashboard/chart-data/dtos/bar-chart-data.dto';
 import {
   ChartDataException,
   ChartDataExceptionCode,
@@ -59,7 +59,7 @@ export class BarChartDataService {
     objectMetadataId,
     configuration,
     authContext,
-  }: GetBarChartDataParams): Promise<BarChartDataOutputDTO> {
+  }: GetBarChartDataParams): Promise<BarChartDataDTO> {
     try {
       const { flatObjectMetadataMaps, flatFieldMetadataMaps } =
         await this.workspaceManyOrAllFlatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
@@ -218,7 +218,7 @@ export class BarChartDataService {
     configuration: BarChartConfigurationDTO;
     userTimezone: string;
     firstDayOfTheWeek: CalendarStartDay;
-  }): BarChartDataOutputDTO {
+  }): BarChartDataDTO {
     const layout = configuration.layout ?? BarChartLayout.VERTICAL;
     const isHorizontal = layout === BarChartLayout.HORIZONTAL;
 
@@ -354,7 +354,7 @@ export class BarChartDataService {
     configuration: BarChartConfigurationDTO;
     userTimezone: string;
     firstDayOfTheWeek: CalendarStartDay;
-  }): BarChartDataOutputDTO {
+  }): BarChartDataDTO {
     const layout = configuration.layout ?? BarChartLayout.VERTICAL;
     const isHorizontal = layout === BarChartLayout.HORIZONTAL;
 

packages/twenty-server/src/modules/dashboard/chart-data/services/line-chart-data.service.ts

@@ -17,7 +17,7 @@ import { EXTRA_ITEM_TO_DETECT_TOO_MANY_GROUPS } from 'src/modules/dashboard/char
 import { LINE_CHART_MAXIMUM_NUMBER_OF_DATA_POINTS } from 'src/modules/dashboard/chart-data/constants/line-chart-maximum-number-of-data-points.constant';
 import { LINE_CHART_MAXIMUM_NUMBER_OF_NON_STACKED_SERIES } from 'src/modules/dashboard/chart-data/constants/line-chart-maximum-number-of-non-stacked-series.constant';
 import { LINE_CHART_MAXIMUM_NUMBER_OF_STACKED_SERIES } from 'src/modules/dashboard/chart-data/constants/line-chart-maximum-number-of-stacked-series.constant';
-import { LineChartDataOutputDTO } from 'src/modules/dashboard/chart-data/dtos/outputs/line-chart-data-output.dto';
+import { LineChartDataDTO } from 'src/modules/dashboard/chart-data/dtos/line-chart-data.dto';
 import {
   ChartDataException,
   ChartDataExceptionCode,
@@ -58,7 +58,7 @@ export class LineChartDataService {
     objectMetadataId,
     configuration,
     authContext,
-  }: GetLineChartDataParams): Promise<LineChartDataOutputDTO> {
+  }: GetLineChartDataParams): Promise<LineChartDataDTO> {
     try {
       const { flatObjectMetadataMaps, flatFieldMetadataMaps } =
         await this.workspaceManyOrAllFlatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
@@ -228,7 +228,7 @@ export class LineChartDataService {
     userTimezone: string;
     firstDayOfTheWeek: CalendarStartDay;
     seriesIdPrefix: string;
-  }): LineChartDataOutputDTO {
+  }): LineChartDataDTO {
     const filteredResults = configuration.omitNullValues
       ? rawResults.filter(
           (result) =>
@@ -355,7 +355,7 @@ export class LineChartDataService {
     userTimezone: string;
     firstDayOfTheWeek: CalendarStartDay;
     seriesIdPrefix: string;
-  }): LineChartDataOutputDTO {
+  }): LineChartDataDTO {
     const filteredResults = configuration.omitNullValues
       ? rawResults.filter(
           (result) =>

packages/twenty-server/src/modules/dashboard/chart-data/services/pie-chart-data.service.ts

@@ -15,7 +15,7 @@ import { PieChartConfigurationDTO } from 'src/engine/metadata-modules/page-layou
 import { WidgetConfigurationType } from 'src/engine/metadata-modules/page-layout-widget/enums/widget-configuration-type.type';
 import { EXTRA_ITEM_TO_DETECT_TOO_MANY_GROUPS } from 'src/modules/dashboard/chart-data/constants/extra-item-to-detect-too-many-groups.constant';
 import { PIE_CHART_MAXIMUM_NUMBER_OF_SLICES } from 'src/modules/dashboard/chart-data/constants/pie-chart-maximum-number-of-slices.constant';
-import { PieChartDataOutputDTO } from 'src/modules/dashboard/chart-data/dtos/outputs/pie-chart-data-output.dto';
+import { PieChartDataDTO } from 'src/modules/dashboard/chart-data/dtos/pie-chart-data.dto';
 import {
   ChartDataException,
   ChartDataExceptionCode,
@@ -46,7 +46,7 @@ export class PieChartDataService {
     objectMetadataId,
     configuration,
     authContext,
-  }: GetPieChartDataParams): Promise<PieChartDataOutputDTO> {
+  }: GetPieChartDataParams): Promise<PieChartDataDTO> {
     try {
       if (
         configuration.configurationType !== WidgetConfigurationType.PIE_CHART
@@ -172,7 +172,7 @@ export class PieChartDataService {
     configuration: PieChartConfigurationDTO;
     userTimezone: string;
     firstDayOfTheWeek: CalendarStartDay;
-  }): PieChartDataOutputDTO {
+  }): PieChartDataDTO {
     const filteredResults = configuration.hideEmptyCategory
       ? rawResults.filter(
           (result) =>