@carlonicora/nextjs-jsonapi 3.22.0 → 3.24.0

package/src/features/oauth/components/__tests__/OAuthClientForm.spec.tsx

@@ -0,0 +1,63 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+import { OAuthClientForm } from "../OAuthClientForm";
+import { OAUTH_SCOPE_DISPLAY, OAuthClientInterface } from "../../interfaces/oauth.interface";
+
+const scopeCheckbox = (name: string) => screen.getByRole("checkbox", { name: new RegExp(name) });
+
+const makeClient = (allowedScopes: string[]): OAuthClientInterface =>
+  ({
+    name: "Existing app",
+    description: undefined,
+    redirectUris: ["https://example.com/callback"],
+    allowedScopes,
+    isConfidential: true,
+  }) as unknown as OAuthClientInterface;
+
+describe("OAuthClientForm", () => {
+  it("renders only the scopes passed in availableScopes", () => {
+    render(<OAuthClientForm onSubmit={vi.fn()} onCancel={vi.fn()} availableScopes={[OAUTH_SCOPE_DISPLAY.mcp]} />);
+
+    expect(screen.getByText("MCP Server Access")).toBeTruthy();
+    expect(screen.queryByText("Read Access")).toBeNull();
+    expect(screen.queryByText("Write Access")).toBeNull();
+  });
+
+  it("preselects defaultScopes in create mode", () => {
+    render(
+      <OAuthClientForm
+        onSubmit={vi.fn()}
+        onCancel={vi.fn()}
+        availableScopes={[OAUTH_SCOPE_DISPLAY.read, OAUTH_SCOPE_DISPLAY.mcp]}
+        defaultScopes={["mcp"]}
+      />,
+    );
+
+    expect(scopeCheckbox("MCP Server Access").getAttribute("aria-checked")).toBe("true");
+    expect(scopeCheckbox("Read Access").getAttribute("aria-checked")).toBe("false");
+  });
+
+  it("uses client.allowedScopes instead of defaultScopes in edit mode", () => {
+    render(
+      <OAuthClientForm
+        client={makeClient(["read"])}
+        onSubmit={vi.fn()}
+        onCancel={vi.fn()}
+        availableScopes={[OAUTH_SCOPE_DISPLAY.read, OAUTH_SCOPE_DISPLAY.mcp]}
+        defaultScopes={["mcp"]}
+      />,
+    );
+
+    expect(scopeCheckbox("Read Access").getAttribute("aria-checked")).toBe("true");
+    expect(scopeCheckbox("MCP Server Access").getAttribute("aria-checked")).toBe("false");
+  });
+
+  it("offers the generic scope list by default, without Only35 scopes", () => {
+    render(<OAuthClientForm onSubmit={vi.fn()} onCancel={vi.fn()} />);
+
+    expect(screen.getByText("MCP Server Access")).toBeTruthy();
+    expect(screen.getByText("Read Access")).toBeTruthy();
+    expect(screen.queryByText("View Photographs")).toBeNull();
+    expect(screen.queryByText("View Rolls")).toBeNull();
+  });
+});

package/src/features/oauth/components/consent/OAuthCompanySelector.tsx

@@ -0,0 +1,54 @@
+"use client";
+
+import { useTranslations } from "next-intl";
+import { useMemo } from "react";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "../../../../shadcnui";
+import { MicroLabel } from "../../../../components/typography";
+
+export interface OAuthCompanySelectorProps {
+  /** The user's companies (studios) */
+  companies: Array<{ id: string; name: string }>;
+  /** The selected company id */
+  value: string | undefined;
+  /** Called with the newly selected company id */
+  onChange: (id: string) => void;
+}
+
+/**
+ * Studio (company) picker for the OAuth consent screen.
+ * Renders nothing when the user belongs to a single company.
+ */
+export function OAuthCompanySelector({ companies, value, onChange }: OAuthCompanySelectorProps) {
+  const t = useTranslations();
+
+  const items = useMemo<Record<string, string>>(
+    () => Object.fromEntries(companies.map((company) => [company.id, company.name])),
+    [companies],
+  );
+
+  if (companies.length <= 1) return null;
+
+  return (
+    <div className="space-y-3">
+      <MicroLabel as="h3">{t("oauth.consent.company_label")}</MicroLabel>
+      <Select
+        items={items}
+        value={value ?? null}
+        onValueChange={(selected) => {
+          if (selected) onChange(String(selected));
+        }}
+      >
+        <SelectTrigger className="w-full" aria-label={t("oauth.consent.company_label")}>
+          <SelectValue placeholder={t("oauth.consent.company_label")} />
+        </SelectTrigger>
+        <SelectContent>
+          {companies.map((company) => (
+            <SelectItem key={company.id} value={company.id}>
+              {company.name}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    </div>
+  );
+}

package/src/features/oauth/components/consent/OAuthConsentActions.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { useTranslations } from "next-intl";
 import { Button } from "../../../../shadcnui";
 
 export interface OAuthConsentActionsProps {
@@ -15,13 +16,15 @@ export interface OAuthConsentActionsProps {
  * Action buttons for OAuth consent screen
  */
 export function OAuthConsentActions({ onApprove, onDeny, isLoading = false }: OAuthConsentActionsProps) {
+  const t = useTranslations();
+
   return (
     <div className="flex flex-col sm:flex-row gap-3">
       <Button variant="outline" onClick={onDeny} disabled={isLoading} className="flex-1">
-        Deny
+        {t("oauth.consent.deny")}
       </Button>
       <Button onClick={onApprove} disabled={isLoading} className="flex-1">
-        {isLoading ? "Authorizing..." : "Authorize"}
+        {isLoading ? t("oauth.consent.authorizing") : t("oauth.consent.authorize")}
       </Button>
     </div>
   );

package/src/features/oauth/components/consent/OAuthConsentHeader.tsx

@@ -1,6 +1,8 @@
 "use client";
 
 import { Shield } from "lucide-react";
+import { useTranslations } from "next-intl";
+import { ContentTitle } from "../../../../components";
 import { OAuthClientInterface } from "../../interfaces/oauth.interface";
 
 export interface OAuthConsentHeaderProps {
@@ -8,15 +10,17 @@ export interface OAuthConsentHeaderProps {
   client: OAuthClientInterface;
   /** Optional logo URL override */
   logoUrl?: string;
-  /** Application name (e.g., "Only35") */
-  appName?: string;
+  /** Application name shown in the header */
+  appName: string;
 }
 
 /**
  * Header component for OAuth consent screen
  * Shows platform logo and requesting app information
  */
-export function OAuthConsentHeader({ client, logoUrl, appName = "Only35" }: OAuthConsentHeaderProps) {
+export function OAuthConsentHeader({ client, logoUrl, appName }: OAuthConsentHeaderProps) {
+  const t = useTranslations();
+
   return (
     <div className="text-center space-y-4">
       {/* Platform Logo */}
@@ -32,9 +36,9 @@ export function OAuthConsentHeader({ client, logoUrl, appName = "Only35" }: OAut
 
       {/* Authorization Request */}
       <div className="space-y-2">
-        <h1 className="text-primary text-3xl font-semibold">Authorize {client.name}</h1>
-        <p className="text-muted-foreground">
-          <span className="font-medium text-foreground">{client.name}</span> wants to access your {appName} account
+        <ContentTitle element={t("oauth.consent.title", { client: client.name })} className="mb-0 justify-center" />
+        <p className="text-muted-foreground text-sm">
+          {t("oauth.consent.wants_access", { client: client.name, appName })}
         </p>
       </div>
     </div>

package/src/features/oauth/components/consent/OAuthConsentScreen.tsx

@@ -1,10 +1,12 @@
 "use client";
 
 import { ExternalLink, AlertTriangle, Loader2 } from "lucide-react";
+import { useTranslations } from "next-intl";
 import { Card, CardContent, CardFooter, Separator, Alert, AlertDescription } from "../../../../shadcnui";
 import { OAuthConsentHeader } from "./OAuthConsentHeader";
 import { OAuthScopeList } from "./OAuthScopeList";
 import { OAuthConsentActions } from "./OAuthConsentActions";
+import { OAuthCompanySelector } from "./OAuthCompanySelector";
 import { useOAuthConsent } from "../../hooks/useOAuthConsent";
 import { OAuthConsentRequest } from "../../interfaces/oauth.interface";
 
@@ -13,12 +15,17 @@ export interface OAuthConsentScreenProps {
   params: OAuthConsentRequest;
   /** Optional platform logo URL */
   logoUrl?: string;
-  /** Platform name */
-  appName?: string;
+  /** Platform name, shown on the consent screen */
+  appName: string;
   /** Terms of Service URL */
   termsUrl?: string;
   /** Privacy Policy URL */
   privacyUrl?: string;
+  /**
+   * The studio open in the host app's session, used as the default studio
+   * choice. Needed by apps that do not mount the package UserProvider.
+   */
+  defaultCompanyId?: string;
 }
 
 /**
@@ -40,11 +47,16 @@ export interface OAuthConsentScreenProps {
 export function OAuthConsentScreen({
   params,
   logoUrl,
-  appName = "Only35",
+  appName,
   termsUrl = "/terms",
   privacyUrl = "/privacy",
+  defaultCompanyId,
 }: OAuthConsentScreenProps) {
-  const { clientInfo, isLoading, error, approve, deny, isSubmitting } = useOAuthConsent(params);
+  const t = useTranslations();
+  const { clientInfo, isLoading, error, approve, deny, isSubmitting, companyId, setCompanyId } = useOAuthConsent(
+    params,
+    { defaultCompanyId },
+  );
 
   // Loading state
   if (isLoading) {
@@ -53,7 +65,7 @@ export function OAuthConsentScreen({
         <Card className="w-full max-w-md">
           <CardContent className="flex flex-col items-center justify-center py-12">
             <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
-            <p className="mt-4 text-muted-foreground">Loading authorization request...</p>
+            <p className="mt-4 text-muted-foreground text-sm">{t("oauth.consent.loading")}</p>
           </CardContent>
         </Card>
       </div>
@@ -68,9 +80,7 @@ export function OAuthConsentScreen({
           <CardContent className="py-8">
             <Alert variant="destructive">
               <AlertTriangle className="h-4 w-4" />
-              <AlertDescription>
-                {error?.message || "Invalid authorization request. Please try again."}
-              </AlertDescription>
+              <AlertDescription>{error?.message || t("oauth.consent.invalid_request")}</AlertDescription>
             </Alert>
           </CardContent>
         </Card>
@@ -79,6 +89,7 @@ export function OAuthConsentScreen({
   }
 
   const { client, scopes } = clientInfo;
+  const companies = clientInfo.companies ?? [];
 
   return (
     <div className="min-h-dvh flex items-center justify-center p-4 bg-muted/30">
@@ -94,11 +105,20 @@ export function OAuthConsentScreen({
 
           <Separator />
 
+          {/* Studio */}
+          {companies.length > 1 && (
+            <>
+              <OAuthCompanySelector companies={companies} value={companyId} onChange={setCompanyId} />
+
+              <Separator />
+            </>
+          )}
+
           {/* Redirect URI Notice */}
           <div className="flex items-start gap-2 text-sm text-muted-foreground">
             <ExternalLink className="h-4 w-4 mt-0.5 flex-shrink-0" />
             <div>
-              <span>Authorizing will redirect you to:</span>
+              <span>{t("oauth.consent.redirect_notice")}</span>
               <p className="tabular-nums text-xs mt-1 break-all">{params.redirectUri}</p>
             </div>
           </div>
@@ -110,13 +130,13 @@ export function OAuthConsentScreen({
         {/* Footer */}
         <CardFooter className="justify-center">
           <p className="text-xs text-center text-muted-foreground">
-            By authorizing, you agree to the app's{" "}
+            {t("oauth.consent.agreement")}{" "}
             <a href={termsUrl} className="hover:text-foreground" target="_blank" rel="noopener">
-              Terms of Service
+              {t("oauth.consent.terms")}
             </a>{" "}
-            and{" "}
+            {t("oauth.consent.and")}{" "}
             <a href={privacyUrl} className="hover:text-foreground" target="_blank" rel="noopener">
-              Privacy Policy
+              {t("oauth.consent.privacy")}
             </a>
             .
           </p>

package/src/features/oauth/components/consent/OAuthScopeList.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { useTranslations } from "next-intl";
 import { Eye, Pencil, Image, Upload, Film, FolderPlus, User, Shield, LucideIcon } from "lucide-react";
 import { OAuthScopeInfo } from "../../interfaces/oauth.interface";
 import { MicroLabel } from "../../../../components/typography";
@@ -25,13 +26,15 @@ const SCOPE_ICONS: Record<string, LucideIcon> = {
  * List of requested OAuth scopes for consent display
  */
 export function OAuthScopeList({ scopes }: OAuthScopeListProps) {
+  const t = useTranslations();
+
   if (scopes.length === 0) {
     return null;
   }
 
   return (
     <div className="space-y-3">
-      <MicroLabel as="h3">This will allow the application to:</MicroLabel>
+      <MicroLabel as="h3">{t("oauth.consent.scopes_heading")}</MicroLabel>
       <ul className="space-y-3">
         {scopes.map((scope) => {
           const IconComponent = scope.icon ? SCOPE_ICONS[scope.icon] : Eye;

package/src/features/oauth/components/consent/__tests__/OAuthConsentHeader.spec.tsx

@@ -0,0 +1,25 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+import { OAuthConsentHeader } from "../OAuthConsentHeader";
+
+const CLIENT = { id: "client-1", name: "Claude" } as any;
+
+describe("OAuthConsentHeader", () => {
+  it("renders the consent title through ContentTitle (page-title recipe), not a raw <h1>", () => {
+    const { container } = render(<OAuthConsentHeader client={CLIENT} appName="Test" />);
+
+    expect(container.querySelector("h1")).toBeNull();
+    const title = screen.getByText("oauth.consent.title");
+    expect(title.className).toContain("text-primary text-3xl font-semibold");
+  });
+
+  it("keeps the title centred with no extra bottom margin", () => {
+    const { container } = render(<OAuthConsentHeader client={CLIENT} appName="Test" />);
+
+    const wrapper = screen.getByText("oauth.consent.title").parentElement?.parentElement as HTMLElement;
+    expect(wrapper.className).toContain("justify-center");
+    expect(wrapper.className).toContain("mb-0");
+    expect(wrapper.className).not.toContain("mb-4");
+    expect(container.firstElementChild?.className).toContain("text-center");
+  });
+});

package/src/features/oauth/components/consent/__tests__/OAuthConsentScreen.spec.tsx

@@ -0,0 +1,126 @@
+import { render, renderHook, screen, waitFor } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { UseOAuthConsentReturn } from "../../../hooks/useOAuthConsent";
+import { OAuthConsentScreen } from "../OAuthConsentScreen";
+
+const { hookState, getAuthorizationInfo, approveAuthorization, currentUserContext } = vi.hoisted(() => ({
+  hookState: { value: null as UseOAuthConsentReturn | null },
+  getAuthorizationInfo: vi.fn(),
+  approveAuthorization: vi.fn(),
+  currentUserContext: vi.fn(),
+}));
+
+// The screen tests drive a controllable hook; the hook tests (hookState.value = null) run the real one.
+vi.mock("../../../hooks/useOAuthConsent", async () => {
+  const actual = await vi.importActual<typeof import("../../../hooks/useOAuthConsent")>(
+    "../../../hooks/useOAuthConsent",
+  );
+  return {
+    ...actual,
+    useOAuthConsent: (
+      params: Parameters<typeof actual.useOAuthConsent>[0],
+      options?: Parameters<typeof actual.useOAuthConsent>[1],
+    ) => hookState.value ?? actual.useOAuthConsent(params, options),
+  };
+});
+
+vi.mock("../../../data/oauth.service", () => ({
+  OAuthService: {
+    getAuthorizationInfo: (params: unknown) => getAuthorizationInfo(params),
+    approveAuthorization: (params: unknown) => approveAuthorization(params),
+    denyAuthorization: vi.fn(),
+  },
+}));
+
+vi.mock("../../../../user/contexts/CurrentUserContext", () => ({
+  useCurrentUserContextOptional: () => currentUserContext(),
+  useCurrentUserContext: () => currentUserContext(),
+}));
+
+const PARAMS = { clientId: "client-1", redirectUri: "https://example.com/callback" };
+const CLIENT = { id: "client-1", name: "Claude" } as any;
+const C1 = { id: "c1", name: "A" };
+const C2 = { id: "c2", name: "B" };
+
+function makeHook(overrides: Partial<UseOAuthConsentReturn> = {}): UseOAuthConsentReturn {
+  return {
+    clientInfo: { client: CLIENT, scopes: [], companies: [C1] },
+    isLoading: false,
+    error: null,
+    approve: vi.fn(),
+    deny: vi.fn(),
+    isSubmitting: false,
+    companyId: "c1",
+    setCompanyId: vi.fn(),
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  hookState.value = null;
+  currentUserContext.mockReturnValue({ company: { id: "c2" } });
+});
+
+describe("OAuthConsentScreen", () => {
+  it("renders no studio picker for a single company", () => {
+    hookState.value = makeHook();
+    render(<OAuthConsentScreen params={PARAMS} appName="Test" />);
+    expect(screen.queryByLabelText("oauth.consent.company_label")).toBeNull();
+  });
+
+  it("renders the studio picker for two companies", () => {
+    hookState.value = makeHook({
+      clientInfo: { client: CLIENT, scopes: [], companies: [C1, C2] },
+      companyId: "c2",
+    });
+    render(<OAuthConsentScreen params={PARAMS} appName="Test" />);
+    expect(screen.getByLabelText("oauth.consent.company_label")).toBeInTheDocument();
+    expect(screen.getByRole("heading", { name: "oauth.consent.company_label" })).toBeInTheDocument();
+  });
+
+  it("renders translated keys, not hardcoded English", () => {
+    hookState.value = makeHook();
+    render(<OAuthConsentScreen params={PARAMS} appName="Test" />);
+    expect(screen.getByText("oauth.consent.authorize")).toBeInTheDocument();
+    expect(screen.queryByText("Authorize")).toBeNull();
+  });
+});
+
+describe("useOAuthConsent", () => {
+  const renderConsentHook = async (options?: { defaultCompanyId?: string }) => {
+    const { useOAuthConsent } = await import("../../../hooks/useOAuthConsent");
+    return renderHook(() => useOAuthConsent(PARAMS, options));
+  };
+
+  it("defaultCompanyId from the host app wins over the package user context", async () => {
+    currentUserContext.mockReturnValue(undefined);
+    getAuthorizationInfo.mockResolvedValue({ client: CLIENT, scopes: [], companies: [C1, C2] });
+    const { result } = await renderConsentHook({ defaultCompanyId: "c2" });
+    await waitFor(() => expect(result.current.companyId).toBe("c2"));
+  });
+
+  it("defaults companyId to the current web-session company when it is in the list", async () => {
+    getAuthorizationInfo.mockResolvedValue({ client: CLIENT, scopes: [], companies: [C1, C2] });
+    const { result } = await renderConsentHook();
+    await waitFor(() => expect(result.current.companyId).toBe("c2"));
+  });
+
+  it("defaults to the first company when the current one is not in the list", async () => {
+    currentUserContext.mockReturnValue({ company: { id: "c9" } });
+    getAuthorizationInfo.mockResolvedValue({ client: CLIENT, scopes: [], companies: [C1, C2] });
+    const { result } = await renderConsentHook();
+    await waitFor(() => expect(result.current.companyId).toBe("c1"));
+  });
+
+  it("approve sends the selected company", async () => {
+    getAuthorizationInfo.mockResolvedValue({ client: CLIENT, scopes: [], companies: [C1, C2] });
+    approveAuthorization.mockResolvedValue({ redirectUrl: "" });
+    const { result } = await renderConsentHook();
+    await waitFor(() => expect(result.current.companyId).toBe("c2"));
+
+    await result.current.approve();
+
+    expect(approveAuthorization).toHaveBeenCalledWith(expect.objectContaining({ companyId: "c2" }));
+  });
+});

package/src/features/oauth/components/consent/index.ts

@@ -2,3 +2,4 @@ export * from "./OAuthConsentHeader";
 export * from "./OAuthScopeList";
 export * from "./OAuthConsentActions";
 export * from "./OAuthConsentScreen";
+export * from "./OAuthCompanySelector";

package/src/features/oauth/data/__tests__/oauth.service.spec.ts

@@ -0,0 +1,103 @@
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { AbstractService } from "../../../../core/abstracts/AbstractService";
+import { ApiRequestDataTypeInterface } from "../../../../core/interfaces/ApiRequestDataTypeInterface";
+import { ModuleRegistry } from "../../../../core/registry/ModuleRegistry";
+import { OAuthConsentRequest } from "../../interfaces/oauth.interface";
+import { OAuthClient } from "../oauth";
+import { OAuthService } from "../oauth.service";
+
+// ModuleRegistry is backed by a globalThis symbol shared across test files in a
+// worker, hence the register-if-absent guard (same idiom as HandbookThreadService.spec.ts).
+const registerIfAbsent = (key: string, module: ApiRequestDataTypeInterface) => {
+  try {
+    ModuleRegistry.get(key as any);
+  } catch {
+    ModuleRegistry.register(key, module);
+  }
+};
+
+beforeAll(() => {
+  registerIfAbsent("OAuth", { name: "oauth-clients", model: OAuthClient } as any);
+});
+
+type CallApiParams = { method: string; endpoint: string; input?: unknown; overridesJsonApiCreation?: boolean };
+const callApiWithMeta = () => vi.spyOn(AbstractService as any, "callApiWithMeta");
+const firstCall = (spy: ReturnType<typeof callApiWithMeta>): CallApiParams => spy.mock.calls[0][0] as CallApiParams;
+
+const fullRequest: OAuthConsentRequest = {
+  clientId: "client-1",
+  redirectUri: "https://example.test/cb",
+  scope: "read mcp",
+  state: "xyz",
+  codeChallenge: "challenge",
+  codeChallengeMethod: "S256",
+  companyId: "11111111-1111-4111-8111-111111111111",
+};
+
+describe("OAuthClient authorization bodies (RFC 6749 wire format)", () => {
+  it("builds the approve body with snake_case keys in wire order", () => {
+    const body = new OAuthClient().createApproveAuthorizationJsonApi(fullRequest);
+
+    expect(JSON.stringify(body)).toBe(
+      JSON.stringify({
+        client_id: "client-1",
+        redirect_uri: "https://example.test/cb",
+        scope: "read mcp",
+        state: "xyz",
+        code_challenge: "challenge",
+        code_challenge_method: "S256",
+        company_id: "11111111-1111-4111-8111-111111111111",
+      }),
+    );
+  });
+
+  it("omits optional approve fields that were not supplied", () => {
+    const body = new OAuthClient().createApproveAuthorizationJsonApi({
+      clientId: "client-1",
+      redirectUri: "https://example.test/cb",
+    });
+
+    expect(JSON.stringify(body)).toBe('{"client_id":"client-1","redirect_uri":"https://example.test/cb"}');
+  });
+
+  it("builds the deny body with only client_id, redirect_uri and state", () => {
+    const body = new OAuthClient().createDenyAuthorizationJsonApi(fullRequest);
+
+    expect(JSON.stringify(body)).toBe(
+      '{"client_id":"client-1","redirect_uri":"https://example.test/cb","state":"xyz"}',
+    );
+  });
+});
+
+describe("OAuthService consent calls", () => {
+  beforeEach(() => vi.restoreAllMocks());
+
+  it("approveAuthorization sends the model's approve body and returns the redirect url", async () => {
+    const spy = callApiWithMeta().mockResolvedValue({ meta: { redirectUrl: "https://example.test/cb?code=1" } });
+
+    const result = await OAuthService.approveAuthorization(fullRequest);
+
+    const call = firstCall(spy);
+    expect(call.method).toBe("POST");
+    expect(call.endpoint).toContain("oauth/authorize/approve");
+    expect(call.overridesJsonApiCreation).toBe(true);
+    expect(call.input).toEqual(new OAuthClient().createApproveAuthorizationJsonApi(fullRequest));
+    expect(result).toEqual({ redirectUrl: "https://example.test/cb?code=1" });
+  });
+
+  it("denyAuthorization sends the model's deny body and returns the redirect url", async () => {
+    const spy = callApiWithMeta().mockResolvedValue({
+      meta: { redirectUrl: "https://example.test/cb?error=access_denied" },
+    });
+
+    const result = await OAuthService.denyAuthorization(fullRequest);
+
+    const call = firstCall(spy);
+    expect(call.method).toBe("POST");
+    expect(call.endpoint).toContain("oauth/authorize/deny");
+    expect(call.overridesJsonApiCreation).toBe(true);
+    expect(call.input).toEqual(new OAuthClient().createDenyAuthorizationJsonApi(fullRequest));
+    expect(result).toEqual({ redirectUrl: "https://example.test/cb?error=access_denied" });
+  });
+});

package/src/features/oauth/data/oauth.service.ts

@@ -7,6 +7,7 @@ import {
   OAuthConsentInfo,
   OAuthConsentRequest,
 } from "../interfaces/oauth.interface";
+import { OAuthClient } from "./oauth";
 
 /**
  * Service for OAuth client management and authorization consent flow.
@@ -151,14 +152,7 @@ export class OAuthService extends AbstractService {
       type: Modules.OAuth,
       method: HttpMethod.POST,
       endpoint: new EndpointCreator({ endpoint: "oauth/authorize/approve" }).generate(),
-      input: {
-        client_id: params.clientId,
-        redirect_uri: params.redirectUri,
-        scope: params.scope,
-        state: params.state,
-        code_challenge: params.codeChallenge,
-        code_challenge_method: params.codeChallengeMethod,
-      },
+      input: new OAuthClient().createApproveAuthorizationJsonApi(params),
       overridesJsonApiCreation: true,
     });
 
@@ -176,11 +170,7 @@ export class OAuthService extends AbstractService {
       type: Modules.OAuth,
       method: HttpMethod.POST,
       endpoint: new EndpointCreator({ endpoint: "oauth/authorize/deny" }).generate(),
-      input: {
-        client_id: params.clientId,
-        redirect_uri: params.redirectUri,
-        state: params.state,
-      },
+      input: new OAuthClient().createDenyAuthorizationJsonApi(params),
       overridesJsonApiCreation: true,
     });
 

package/src/features/oauth/data/oauth.ts

@@ -1,5 +1,5 @@
 import { AbstractApiData, JsonApiHydratedDataInterface } from "../../../core";
-import { OAuthClientInput, OAuthClientInterface } from "../interfaces/oauth.interface";
+import { OAuthClientInput, OAuthClientInterface, OAuthConsentRequest } from "../interfaces/oauth.interface";
 
 /**
  * OAuth client data model
@@ -84,4 +84,33 @@ export class OAuthClient extends AbstractApiData implements OAuthClientInterface
 
     return response;
   }
+
+  /**
+   * Body for POST /oauth/authorize/approve.
+   * The authorize endpoints speak the RFC 6749 wire format (snake_case keys,
+   * no JSON:API envelope), so this dedicated method owns that shape and the
+   * service sends it with `overridesJsonApiCreation`.
+   */
+  createApproveAuthorizationJsonApi(params: OAuthConsentRequest) {
+    return {
+      client_id: params.clientId,
+      redirect_uri: params.redirectUri,
+      scope: params.scope,
+      state: params.state,
+      code_challenge: params.codeChallenge,
+      code_challenge_method: params.codeChallengeMethod,
+      company_id: params.companyId,
+    };
+  }
+
+  /**
+   * Body for POST /oauth/authorize/deny (RFC 6749 wire format, see above).
+   */
+  createDenyAuthorizationJsonApi(params: OAuthConsentRequest) {
+    return {
+      client_id: params.clientId,
+      redirect_uri: params.redirectUri,
+      state: params.state,
+    };
+  }
 }