Add identity-scoped OAuth token management

Let users create, list, and revoke manual bearer tokens from
/me/oauth-tokens, scoped to their identity rather than an
organization. Manual tokens store a null client_id and are
authorized with a self-manage IAM policy.

Wire Connect GraphQL on Identity (list, create, revoke), add
console UI with scoped create flow and credentials dialog, and
cover the flow in e2e tests. Fix list pagination ordering and
keep the Relay connection in sync after create.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/connect/v1/base_resolvers.go

@@ -122,6 +122,16 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 
 			return types.NewPersonalAPIKey(personalAPIKey), nil
 		}
+	case coredata.OAuth2AccessTokenEntityType:
+		action = iam.ActionOAuth2AccessTokenGet
+		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
+			accessToken, err := r.iam.OAuth2ServerService.GetAccessTokenByID(ctx, id)
+			if err != nil {
+				return nil, err
+			}
+
+			return types.NewOAuth2AccessToken(accessToken), nil
+		}
 	case coredata.SCIMConfigurationEntityType:
 		action = iam.ActionSCIMConfigurationGet
 		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
@@ -256,6 +266,18 @@ func (r *queryResolver) SignUpEnabled(ctx context.Context) (bool, error) {
 	return r.iam.IsSignUpEnabled(), nil
 }
 
+// Oauth2ScopesSupported is the resolver for the oauth2ScopesSupported field.
+func (r *queryResolver) Oauth2ScopesSupported(ctx context.Context) ([]string, error) {
+	apiScopes := r.iam.Authorizer.APIScopes()
+
+	scopes := make([]string, len(apiScopes))
+	for i, scope := range apiScopes {
+		scopes[i] = scope.String()
+	}
+
+	return scopes, nil
+}
+
 // Mutation returns schema.MutationResolver implementation.
 func (r *Resolver) Mutation() schema.MutationResolver { return &mutationResolver{r} }
 

pkg/server/api/connect/v1/graphql/base.graphql

@@ -33,6 +33,9 @@ type Query {
   signUpEnabled: Boolean!
     @goField(forceResolver: true)
     @authentication(required: OPTIONAL)
+  oauth2ScopesSupported: [String!]!
+    @goField(forceResolver: true)
+    @authentication(required: OPTIONAL)
 }
 
 type OIDCProviderInfo {

pkg/server/api/connect/v1/graphql/identity.graphql

@@ -33,6 +33,16 @@ type Identity implements Node {
     @authentication(required: PRESENT)
     @sessionOnly
 
+  oauth2AccessTokens(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): OAuth2AccessTokenConnection
+    @goField(forceResolver: true)
+    @authentication(required: PRESENT)
+    @sessionOnly
+
   invitingOrganizations: [Organization!]!
     @goField(forceResolver: true)
     @authentication(required: PRESENT)

pkg/server/api/connect/v1/graphql/oauth2_access_token.graphql

@@ -0,0 +1,58 @@
+type OAuth2AccessToken implements Node {
+  id: ID!
+  name: String!
+  scopes: [String!]!
+  expiresAt: Datetime!
+  createdAt: Datetime!
+  permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type OAuth2AccessTokenConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.OAuth2AccessTokenConnection"
+  ) {
+  edges: [OAuth2AccessTokenEdge!]!
+  pageInfo: PageInfo!
+  totalCount: Int @goField(forceResolver: true)
+}
+
+type OAuth2AccessTokenEdge {
+  node: OAuth2AccessToken!
+  cursor: CursorKey!
+}
+
+extend type Mutation {
+  createOAuth2AccessToken(
+    input: CreateOAuth2AccessTokenInput!
+  ): CreateOAuth2AccessTokenPayload
+    @authentication(required: PRESENT)
+    @sessionOnly
+
+  revokeOAuth2AccessToken(
+    input: RevokeOAuth2AccessTokenInput!
+  ): RevokeOAuth2AccessTokenPayload
+    @authentication(required: PRESENT)
+    @sessionOnly
+}
+
+input CreateOAuth2AccessTokenInput
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/connect/v1/types.CreateOAuth2AccessTokenInput"
+  ) {
+  name: String!
+  expiresAt: Datetime!
+  scopes: [String!]!
+}
+
+input RevokeOAuth2AccessTokenInput {
+  oauth2AccessTokenId: ID!
+}
+
+type CreateOAuth2AccessTokenPayload {
+  oauth2AccessTokenEdge: OAuth2AccessTokenEdge!
+  token: String!
+}
+
+type RevokeOAuth2AccessTokenPayload {
+  oauth2AccessTokenId: ID!
+}

pkg/server/api/connect/v1/identity_resolvers.go

@@ -130,6 +130,36 @@ func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Ident
 	return types.NewPersonalAPIKeyConnection(page, r, obj.ID), nil
 }
 
+// Oauth2AccessTokens is the resolver for the oauth2AccessTokens field.
+func (r *identityResolver) Oauth2AccessTokens(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.OAuth2AccessTokenConnection, error) {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionOAuth2AccessTokenList); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyTotalCountSelected(ctx) {
+		return &types.OAuth2AccessTokenConnection{
+			Resolver: r,
+			ParentID: obj.ID,
+		}, nil
+	}
+
+	pageOrderBy := page.OrderBy[coredata.OAuth2AccessTokenOrderField]{
+		Field:     coredata.OAuth2AccessTokenOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+
+	cursor := cursor.NewCursor(first, after, last, before, pageOrderBy)
+
+	tokenPage, err := r.iam.OAuth2ServerService.ListAccessTokensByIdentityID(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list oauth2 access tokens", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewOAuth2AccessTokenConnection(tokenPage, r, obj.ID), nil
+}
+
 // InvitingOrganizations is the resolver for the invitingOrganizations field.
 func (r *identityResolver) InvitingOrganizations(ctx context.Context, obj *types.Identity) ([]*types.Organization, error) {
 	if _, err := r.authorize(ctx, obj.ID, iam.ActionInvitationList, authz.WithSkipAssumptionCheck()); err != nil {

pkg/server/api/connect/v1/oauth2_access_token_resolvers.go

@@ -0,0 +1,121 @@
+package connect_v1
+
+// This file will be automatically regenerated based on the schema, any resolver
+// implementations
+// will be copied through when generating and any unknown code will be moved to the end.
+// Code generated by github.com/99designs/gqlgen version v0.17.90
+
+import (
+	"context"
+	"errors"
+	"strings"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/iam/oauth2"
+	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
+	"go.probo.inc/probo/pkg/server/gqlutils"
+)
+
+// CreateOAuth2AccessToken is the resolver for the createOAuth2AccessToken field.
+func (r *mutationResolver) CreateOAuth2AccessToken(ctx context.Context, input types.CreateOAuth2AccessTokenInput) (*types.CreateOAuth2AccessTokenPayload, error) {
+	identity := authn.IdentityFromContext(ctx)
+
+	if _, err := r.authorize(ctx, identity.ID, iam.ActionOAuth2AccessTokenCreate); err != nil {
+		return nil, err
+	}
+
+	scopes, err := input.ParsedScopes()
+	if err != nil {
+		return nil, gqlutils.Invalid(ctx, err)
+	}
+
+	tokenValue, accessToken, err := r.iam.OAuth2ServerService.CreateManualAccessToken(
+		ctx,
+		&oauth2.CreateManualAccessTokenRequest{
+			IdentityID:       identity.ID,
+			Name:             strings.TrimSpace(input.Name),
+			ExpiresAt:        input.ExpiresAt,
+			Scopes:           scopes,
+			AllowedAPIScopes: r.iam.Authorizer.APIScopes(),
+		},
+	)
+	if err != nil {
+		if oauth2Err, ok := errors.AsType[*oauth2.OAuth2Error](err); ok {
+			return nil, gqlutils.Invalid(ctx, oauth2Err)
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot create oauth2 access token", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.CreateOAuth2AccessTokenPayload{
+		Oauth2AccessTokenEdge: types.NewOAuth2AccessTokenEdge(
+			accessToken,
+			coredata.OAuth2AccessTokenOrderFieldCreatedAt,
+		),
+		Token: tokenValue,
+	}, nil
+}
+
+// RevokeOAuth2AccessToken is the resolver for the revokeOAuth2AccessToken field.
+func (r *mutationResolver) RevokeOAuth2AccessToken(ctx context.Context, input types.RevokeOAuth2AccessTokenInput) (*types.RevokeOAuth2AccessTokenPayload, error) {
+	if _, err := r.authorize(ctx, input.Oauth2AccessTokenID, iam.ActionOAuth2AccessTokenDelete); err != nil {
+		return nil, err
+	}
+
+	if err := r.iam.OAuth2ServerService.RevokeAccessToken(ctx, input.Oauth2AccessTokenID); err != nil {
+		r.logger.ErrorCtx(ctx, "cannot revoke oauth2 access token", log.Error(err))
+
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.RevokeOAuth2AccessTokenPayload{
+		Oauth2AccessTokenID: input.Oauth2AccessTokenID,
+	}, nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *oAuth2AccessTokenResolver) Permission(ctx context.Context, obj *types.OAuth2AccessToken, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *oAuth2AccessTokenConnectionResolver) TotalCount(ctx context.Context, obj *types.OAuth2AccessTokenConnection) (*int, error) {
+	switch obj.Resolver.(type) {
+	case *identityResolver:
+		if _, err := r.authorize(ctx, obj.ParentID, iam.ActionOAuth2AccessTokenList); err != nil {
+			return nil, err
+		}
+
+		count, err := r.iam.OAuth2ServerService.CountAccessTokensByIdentityID(ctx, obj.ParentID)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot count oauth2 access tokens", log.Error(err))
+
+			return nil, gqlutils.Internal(ctx)
+		}
+
+		return &count, nil
+	}
+
+	r.logger.ErrorCtx(ctx, "unsupported resolver", log.Any("resolver", obj.Resolver))
+
+	return nil, gqlutils.Internal(ctx)
+}
+
+// OAuth2AccessToken returns schema.OAuth2AccessTokenResolver implementation.
+func (r *Resolver) OAuth2AccessToken() schema.OAuth2AccessTokenResolver {
+	return &oAuth2AccessTokenResolver{r}
+}
+
+// OAuth2AccessTokenConnection returns schema.OAuth2AccessTokenConnectionResolver implementation.
+func (r *Resolver) OAuth2AccessTokenConnection() schema.OAuth2AccessTokenConnectionResolver {
+	return &oAuth2AccessTokenConnectionResolver{r}
+}
+
+type oAuth2AccessTokenResolver struct{ *Resolver }
+type oAuth2AccessTokenConnectionResolver struct{ *Resolver }

pkg/server/api/connect/v1/types/oauth2_access_token.go

@@ -0,0 +1,98 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"errors"
+	"time"
+
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	CreateOAuth2AccessTokenInput struct {
+		Name      string    `json:"name"`
+		ExpiresAt time.Time `json:"expiresAt"`
+		Scopes    []string  `json:"scopes"`
+	}
+
+	OAuth2AccessTokenConnection struct {
+		TotalCount int
+		Edges      []*OAuth2AccessTokenEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+)
+
+func (in *CreateOAuth2AccessTokenInput) ParsedScopes() (coredata.OAuth2Scopes, error) {
+	if len(in.Scopes) == 0 {
+		return nil, errors.New("scopes are required")
+	}
+
+	scopes := make(coredata.OAuth2Scopes, len(in.Scopes))
+	for i, scopeString := range in.Scopes {
+		scopes[i] = coredata.OAuth2Scope(scopeString)
+	}
+
+	return scopes, nil
+}
+
+func NewOAuth2AccessTokenConnection(
+	p *page.Page[*coredata.OAuth2AccessToken, coredata.OAuth2AccessTokenOrderField],
+	resolver any,
+	parentID gid.GID,
+) *OAuth2AccessTokenConnection {
+	edges := make([]*OAuth2AccessTokenEdge, len(p.Data))
+	for i, token := range p.Data {
+		edges[i] = NewOAuth2AccessTokenEdge(token, p.Cursor.OrderBy.Field)
+	}
+
+	return &OAuth2AccessTokenConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: resolver,
+		ParentID: parentID,
+	}
+}
+
+func NewOAuth2AccessTokenEdge(
+	token *coredata.OAuth2AccessToken,
+	orderField coredata.OAuth2AccessTokenOrderField,
+) *OAuth2AccessTokenEdge {
+	return &OAuth2AccessTokenEdge{
+		Node:   NewOAuth2AccessToken(token),
+		Cursor: token.CursorKey(orderField),
+	}
+}
+
+func NewOAuth2AccessToken(token *coredata.OAuth2AccessToken) *OAuth2AccessToken {
+	scopes := make([]string, len(token.Scopes))
+	for i, scope := range token.Scopes {
+		scopes[i] = string(scope)
+	}
+
+	return &OAuth2AccessToken{
+		ID:        token.ID,
+		Name:      token.Name,
+		Scopes:    scopes,
+		ExpiresAt: token.ExpiresAt,
+		CreatedAt: token.CreatedAt,
+	}
+}