Add OAuth2 server module with token verification and management APIs

[Copilot]

Implements OAuth2 server functionality for token verification, validation, and personal access token management.

New APIs

Token Verification

• GET /oauth/token/info - Verify token validity with expiration check
• GET /oauth/token/details - Get comprehensive token metadata
• POST /oauth/token/validate - Validate token from request body

Personal Access Token Management

• GET /oauth/personal-access-tokens - List user's tokens
• POST /oauth/personal-access-tokens - Create token (returns once)
• DELETE /oauth/personal-access-tokens/:token_id - Revoke token

Health Check

• GET /ayaka/oauth2-server - Module status endpoint

Implementation

Module Structure (services/web/modules/oauth2-server/)

• SecretsHelper.js - SHA-512 token hashing (matches existing Overleaf OAuth implementation)
• Oauth2Server.js - Token lookup, verification, and expiration logic
• OAuthPersonalAccessTokenManager.mjs - CRUD operations on oauthAccessTokens collection
• TokenController.js - Token verification endpoints with Bearer token extraction
• OAuthPersonalAccessTokenController.js - Protected endpoints requiring login
• Oauth2ServerRouter.mjs - Route definitions

Token Format

• Prefix: olpat_ (64 hex chars)
• Storage: SHA-512 hash in oauthAccessTokens.accessToken
• Display: Last 8 chars in accessTokenPartial
• Tracking: Updates lastUsedAt on each use

Usage

# Verify token validity
curl -H "Authorization: Bearer olpat_..." \
  http://localhost:3000/oauth/token/info

# Response
{
  "valid": true,
  "token": {
    "type": "personal",
    "scope": "*",
    "user_id": "...",
    "createdAt": "...",
    "expiresAt": null
  }
}

Configuration

Added oauth2-server to moduleImportSequence in services/web/config/settings.defaults.js for automatic module loading.

Original prompt

import logger from '@overleaf/logger'
import AuthenticationController from '../../../../app/src/Features/Authentication/AuthenticationController.mjs'
import OAuthPersonalAccessTokenController from './OAuthPersonalAccessTokenController.js'
import TokenController from './TokenController.js'

export default {
apply(webRouter) {
logger.debug({}, 'Oauth2Server router')
webRouter.get('/ayaka/oauth2-server', (req, res) => {
res.json({ message: 'Dev by ayaka-notes' })
})

    webRouter.get('/oauth/token/info', TokenController.checkOAuthToken)

    webRouter.get('/oauth/personal-access-tokens',
        AuthenticationController.requireLogin(),
        OAuthPersonalAccessTokenController.getUserPersonalAccessTokens
    )

    webRouter.post('/oauth/personal-access-tokens',
        AuthenticationController.requireLogin(),
        OAuthPersonalAccessTokenController.createPersonalAccessToken
    )

    webRouter.delete('/oauth/personal-access-tokens/:token_id',
        AuthenticationController.requireLogin(),
        OAuthPersonalAccessTokenController.deletePersonalAccessToken
    )
}

}
我觉得你之前写的不错 但是还需要下面几个api 起码我要能获取、验证、还有校验是否一个oauth token是合法的吧 具体我该怎么做 教我

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.