shutro-erp 0.3.2 → 0.3.4

package/dist/sale_project/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 698d6a45d2c40df8
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 7dbe00f1ac846381
 // Schema view of module `sale_project` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -8,9 +8,11 @@ export interface SchemaView {
   readonly 'audit.event': AuditEvent;
   readonly 'auth.api_key': AuthApiKey;
   readonly 'auth.credential': AuthCredential;
+  readonly 'auth.policy': AuthPolicy;
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
+  readonly 'kosh.image': KoshImage;
   readonly 'kosh.saved_view': KoshSavedView;
   readonly 'mail.activity': MailActivity;
   readonly 'mail.activity.type': MailActivityType;
@@ -19,6 +21,10 @@ export interface SchemaView {
   readonly 'mail.follower': MailFollower;
   readonly 'mail.message': MailMessage;
   readonly 'mail.message.reaction': MailMessageReaction;
+  readonly 'oauth.app': OauthApp;
+  readonly 'oauth.code': OauthCode;
+  readonly 'oauth.grant': OauthGrant;
+  readonly 'oauth.token': OauthToken;
   readonly 'product.category': ProductCategory;
   readonly 'product.product': ProductProduct;
   readonly 'project.project': ProjectProject;
@@ -140,6 +146,26 @@ export interface AuthCredential {
 export interface AuthCredentialMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.credential'> {
 }
 
+/** `auth.policy` (owner: base). */
+export interface AuthPolicy {
+  readonly name: 'auth.policy';
+  readonly fields: {
+    readonly id: F.Id<'auth.policy'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly twoFactor: F.Selection<'administrators' | 'everyone', { readonly required: true; readonly default: true }>;
+    readonly sessionDays: F.Integer;
+  };
+  readonly methods: AuthPolicyMethods;
+}
+
+/** Methods of `auth.policy`: declared ones and transitions. */
+export interface AuthPolicyMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.policy'> {
+}
+
 /** `auth.session` (owner: base). */
 export interface AuthSession {
   readonly name: 'auth.session';
@@ -212,6 +238,29 @@ export interface AuthUserGroup {
 export interface AuthUserGroupMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.user_group'> {
 }
 
+/** `kosh.image` (owner: base). */
+export interface KoshImage {
+  readonly name: 'kosh.image';
+  readonly fields: {
+    readonly id: F.Id<'kosh.image'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly ownerModel: F.Char<{ readonly required: true }>;
+    readonly ownerId: F.Integer<{ readonly required: true }>;
+    readonly mime: F.Char<{ readonly required: true }>;
+    readonly data: F.Text<{ readonly required: true }>;
+    readonly hash: F.Char<{ readonly required: true }>;
+  };
+  readonly methods: KoshImageMethods;
+}
+
+/** Methods of `kosh.image`: declared ones and transitions. */
+export interface KoshImageMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'kosh.image'> {
+}
+
 /** `kosh.saved_view` (owner: base). */
 export interface KoshSavedView {
   readonly name: 'kosh.saved_view';
@@ -414,6 +463,105 @@ export interface MailMessageReaction {
 export interface MailMessageReactionMethods extends F.Methods<typeof import('../../messaging/index.js').messagingShutro, 'mail.message.reaction'> {
 }
 
+/** `oauth.app` (owner: base). */
+export interface OauthApp {
+  readonly name: 'oauth.app';
+  readonly fields: {
+    readonly id: F.Id<'oauth.app'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly name: F.Char<{ readonly required: true }>;
+    readonly clientId: F.Char<{ readonly required: true }>;
+    readonly secretHash: F.Char;
+    readonly confidential: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly redirectUris: F.Text<{ readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly homepage: F.Char;
+    readonly active: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly owner: F.Many2one<'res.users'>;
+  };
+  readonly methods: OauthAppMethods;
+}
+
+/** Methods of `oauth.app`: declared ones and transitions. */
+export interface OauthAppMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.app'> {
+}
+
+/** `oauth.code` (owner: base). */
+export interface OauthCode {
+  readonly name: 'oauth.code';
+  readonly fields: {
+    readonly id: F.Id<'oauth.code'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly codeHash: F.Char<{ readonly required: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly redirectUri: F.Char<{ readonly required: true }>;
+    readonly challenge: F.Char;
+    readonly expiresAt: F.Datetime<{ readonly required: true }>;
+    readonly used: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthCodeMethods;
+}
+
+/** Methods of `oauth.code`: declared ones and transitions. */
+export interface OauthCodeMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.code'> {
+}
+
+/** `oauth.grant` (owner: base). */
+export interface OauthGrant {
+  readonly name: 'oauth.grant';
+  readonly fields: {
+    readonly id: F.Id<'oauth.grant'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly user: F.Many2one<'res.users', { readonly required: true }>;
+    readonly app: F.Many2one<'oauth.app', { readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly lastUsedAt: F.Datetime;
+  };
+  readonly methods: OauthGrantMethods;
+}
+
+/** Methods of `oauth.grant`: declared ones and transitions. */
+export interface OauthGrantMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.grant'> {
+}
+
+/** `oauth.token` (owner: base). */
+export interface OauthToken {
+  readonly name: 'oauth.token';
+  readonly fields: {
+    readonly id: F.Id<'oauth.token'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly accessHash: F.Char<{ readonly required: true }>;
+    readonly refreshHash: F.Char<{ readonly required: true }>;
+    readonly accessExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly refreshExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly rotated: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthTokenMethods;
+}
+
+/** Methods of `oauth.token`: declared ones and transitions. */
+export interface OauthTokenMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.token'> {
+}
+
 /** `product.category` (owner: product). */
 export interface ProductCategory {
   readonly name: 'product.category';
@@ -596,6 +744,13 @@ export interface ResCompany {
     readonly name: F.Char<{ readonly required: true }>;
     readonly currency: F.Many2one<'res.currency', { readonly required: true }>;
     readonly numberGrouping: F.Selection<'international' | 'lakh', { readonly required: true; readonly default: true }>;
+    readonly accentColor: F.Char;
+    readonly street: F.Char;
+    readonly city: F.Char;
+    readonly zip: F.Char;
+    readonly email: F.Char;
+    readonly phone: F.Char;
+    readonly website: F.Char;
   };
   readonly methods: ResCompanyMethods;
 }

package/dist/sales/.kosh/bindings.js

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: b513566045fc25a0
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 680b65ef8ba5f90d
 // Bindings of module `sales`: import the definition API from here to get types scoped to what it can see.
 export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
 import { definitions } from '../../server/orm.js';

package/dist/sales/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: b513566045fc25a0
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 680b65ef8ba5f90d
 // Schema view of module `sales` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -8,9 +8,11 @@ export interface SchemaView {
   readonly 'audit.event': AuditEvent;
   readonly 'auth.api_key': AuthApiKey;
   readonly 'auth.credential': AuthCredential;
+  readonly 'auth.policy': AuthPolicy;
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
+  readonly 'kosh.image': KoshImage;
   readonly 'kosh.saved_view': KoshSavedView;
   readonly 'mail.activity': MailActivity;
   readonly 'mail.activity.type': MailActivityType;
@@ -19,6 +21,10 @@ export interface SchemaView {
   readonly 'mail.follower': MailFollower;
   readonly 'mail.message': MailMessage;
   readonly 'mail.message.reaction': MailMessageReaction;
+  readonly 'oauth.app': OauthApp;
+  readonly 'oauth.code': OauthCode;
+  readonly 'oauth.grant': OauthGrant;
+  readonly 'oauth.token': OauthToken;
   readonly 'product.category': ProductCategory;
   readonly 'product.product': ProductProduct;
   readonly 'res.company': ResCompany;
@@ -136,6 +142,26 @@ export interface AuthCredential {
 export interface AuthCredentialMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.credential'> {
 }
 
+/** `auth.policy` (owner: base). */
+export interface AuthPolicy {
+  readonly name: 'auth.policy';
+  readonly fields: {
+    readonly id: F.Id<'auth.policy'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly twoFactor: F.Selection<'administrators' | 'everyone', { readonly required: true; readonly default: true }>;
+    readonly sessionDays: F.Integer;
+  };
+  readonly methods: AuthPolicyMethods;
+}
+
+/** Methods of `auth.policy`: declared ones and transitions. */
+export interface AuthPolicyMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.policy'> {
+}
+
 /** `auth.session` (owner: base). */
 export interface AuthSession {
   readonly name: 'auth.session';
@@ -208,6 +234,29 @@ export interface AuthUserGroup {
 export interface AuthUserGroupMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.user_group'> {
 }
 
+/** `kosh.image` (owner: base). */
+export interface KoshImage {
+  readonly name: 'kosh.image';
+  readonly fields: {
+    readonly id: F.Id<'kosh.image'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly ownerModel: F.Char<{ readonly required: true }>;
+    readonly ownerId: F.Integer<{ readonly required: true }>;
+    readonly mime: F.Char<{ readonly required: true }>;
+    readonly data: F.Text<{ readonly required: true }>;
+    readonly hash: F.Char<{ readonly required: true }>;
+  };
+  readonly methods: KoshImageMethods;
+}
+
+/** Methods of `kosh.image`: declared ones and transitions. */
+export interface KoshImageMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'kosh.image'> {
+}
+
 /** `kosh.saved_view` (owner: base). */
 export interface KoshSavedView {
   readonly name: 'kosh.saved_view';
@@ -410,6 +459,105 @@ export interface MailMessageReaction {
 export interface MailMessageReactionMethods extends F.Methods<typeof import('../../messaging/index.js').messagingShutro, 'mail.message.reaction'> {
 }
 
+/** `oauth.app` (owner: base). */
+export interface OauthApp {
+  readonly name: 'oauth.app';
+  readonly fields: {
+    readonly id: F.Id<'oauth.app'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly name: F.Char<{ readonly required: true }>;
+    readonly clientId: F.Char<{ readonly required: true }>;
+    readonly secretHash: F.Char;
+    readonly confidential: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly redirectUris: F.Text<{ readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly homepage: F.Char;
+    readonly active: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly owner: F.Many2one<'res.users'>;
+  };
+  readonly methods: OauthAppMethods;
+}
+
+/** Methods of `oauth.app`: declared ones and transitions. */
+export interface OauthAppMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.app'> {
+}
+
+/** `oauth.code` (owner: base). */
+export interface OauthCode {
+  readonly name: 'oauth.code';
+  readonly fields: {
+    readonly id: F.Id<'oauth.code'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly codeHash: F.Char<{ readonly required: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly redirectUri: F.Char<{ readonly required: true }>;
+    readonly challenge: F.Char;
+    readonly expiresAt: F.Datetime<{ readonly required: true }>;
+    readonly used: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthCodeMethods;
+}
+
+/** Methods of `oauth.code`: declared ones and transitions. */
+export interface OauthCodeMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.code'> {
+}
+
+/** `oauth.grant` (owner: base). */
+export interface OauthGrant {
+  readonly name: 'oauth.grant';
+  readonly fields: {
+    readonly id: F.Id<'oauth.grant'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly user: F.Many2one<'res.users', { readonly required: true }>;
+    readonly app: F.Many2one<'oauth.app', { readonly required: true }>;
+    readonly scopes: F.Char<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly lastUsedAt: F.Datetime;
+  };
+  readonly methods: OauthGrantMethods;
+}
+
+/** Methods of `oauth.grant`: declared ones and transitions. */
+export interface OauthGrantMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.grant'> {
+}
+
+/** `oauth.token` (owner: base). */
+export interface OauthToken {
+  readonly name: 'oauth.token';
+  readonly fields: {
+    readonly id: F.Id<'oauth.token'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly grant: F.Many2one<'oauth.grant', { readonly required: true }>;
+    readonly accessHash: F.Char<{ readonly required: true }>;
+    readonly refreshHash: F.Char<{ readonly required: true }>;
+    readonly accessExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly refreshExpiresAt: F.Datetime<{ readonly required: true }>;
+    readonly revoked: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly rotated: F.Bool<{ readonly required: true; readonly default: true }>;
+  };
+  readonly methods: OauthTokenMethods;
+}
+
+/** Methods of `oauth.token`: declared ones and transitions. */
+export interface OauthTokenMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'oauth.token'> {
+}
+
 /** `product.category` (owner: product). */
 export interface ProductCategory {
   readonly name: 'product.category';
@@ -477,6 +625,13 @@ export interface ResCompany {
     readonly name: F.Char<{ readonly required: true }>;
     readonly currency: F.Many2one<'res.currency', { readonly required: true }>;
     readonly numberGrouping: F.Selection<'international' | 'lakh', { readonly required: true; readonly default: true }>;
+    readonly accentColor: F.Char;
+    readonly street: F.Char;
+    readonly city: F.Char;
+    readonly zip: F.Char;
+    readonly email: F.Char;
+    readonly phone: F.Char;
+    readonly website: F.Char;
   };
   readonly methods: ResCompanyMethods;
 }

package/dist/server/auth/base.js

@@ -22,6 +22,15 @@ const ResCompany = defineModel('res.company', {
         currency: f.many2one('res.currency', { required: true }),
         /** How numbers are grouped on screen and in documents (RFC 0016): 1,234,567 or 12,34,567 (lakh and crore). */
         numberGrouping: f.selection({ international: 'International (1,234,567)', lakh: 'Lakh and crore (12,34,567)' }, { required: true, default: 'international', label: 'Number grouping' }),
+        /** The company's brand colour (`#4f46e5`), the back-office's accent (RFC 0018); the default when empty. */
+        accentColor: f.char({ size: 7, label: 'Brand colour' }),
+        /** Its address and how to reach it (RFC 0019 §3.4): on documents, e-invoices and the portal. */
+        street: f.char({ label: 'Address' }),
+        city: f.char({ label: 'City' }),
+        zip: f.char({ size: 12, label: 'Postal code' }),
+        email: f.char({ label: 'Email' }),
+        phone: f.char({ label: 'Phone' }),
+        website: f.char({ label: 'Website' }),
     },
 });
 const readRows = async (env, model, ids, keys) => env.asSuperuser({ reason: 'check administrators' }, async (su) => {
@@ -127,6 +136,83 @@ const AuthUserGrant = defineModel('auth.user_grant', {
         reason: f.char({ required: true }),
     },
 });
+/**
+ * The installation's security policy (RFC 0019 §3.5): one row, read by the auth service, changed in Settings ›
+ * Security. Without a row: two-factor sign-in for administrators only, sessions as the server is configured.
+ */
+const AuthPolicy = defineModel('auth.policy', {
+    fields: {
+        twoFactor: f.selection({ administrators: 'Administrators', everyone: 'Everyone' }, { required: true, default: 'administrators', label: 'Two-factor sign-in required for' }),
+        /** Days a sign-in lasts at most; empty: the server's setting. */
+        sessionDays: f.integer({ label: 'Session lifetime (days)' }),
+    },
+});
+/**
+ * OAuth 2.0 apps (RFC 0017 §5.2): third-party applications that act for a user who consented, within scopes. The
+ * client secret (confidential apps) is stored as a digest; public apps rely on PKCE. Private: managed by the
+ * Integrations routes and the OAuth flow.
+ */
+const OAuthApp = defineModel('oauth.app', {
+    fields: {
+        name: f.char({ required: true }),
+        clientId: f.char({ required: true, index: 'unique' }),
+        secretHash: f.char(),
+        confidential: f.boolean({ default: true }),
+        /** One per line; the redirect must match one exactly. */
+        redirectUris: f.text({ required: true }),
+        /** The scopes it may ask for, space separated (`*`, `read:<app>`, `write:<app>`). */
+        scopes: f.char({ required: true }),
+        homepage: f.char(),
+        active: f.boolean({ default: true }),
+        owner: f.many2one('res.users', { ondelete: 'set null' }),
+    },
+});
+/** A user's consent to an app, with the scopes granted; revoking it ends every token of it. */
+const OAuthGrant = defineModel('oauth.grant', {
+    fields: {
+        user: f.many2one('res.users', { required: true, ondelete: 'cascade' }),
+        app: f.many2one('oauth.app', { required: true, ondelete: 'cascade' }),
+        scopes: f.char({ required: true }),
+        revoked: f.boolean({ default: false }),
+        lastUsedAt: f.datetime(),
+    },
+});
+/** An authorization code: once, for 10 minutes, bound to its redirect and its PKCE challenge. */
+const OAuthCode = defineModel('oauth.code', {
+    fields: {
+        codeHash: f.char({ required: true, index: 'unique' }),
+        grant: f.many2one('oauth.grant', { required: true, ondelete: 'cascade' }),
+        redirectUri: f.char({ required: true }),
+        challenge: f.char(),
+        expiresAt: f.datetime({ required: true }),
+        used: f.boolean({ default: false }),
+    },
+});
+/** An access token (1 hour) and its refresh token (rotated at each use), both stored as digests. */
+const OAuthToken = defineModel('oauth.token', {
+    fields: {
+        grant: f.many2one('oauth.grant', { required: true, ondelete: 'cascade' }),
+        accessHash: f.char({ required: true, index: 'unique' }),
+        refreshHash: f.char({ required: true, index: 'unique' }),
+        accessExpiresAt: f.datetime({ required: true }),
+        refreshExpiresAt: f.datetime({ required: true }),
+        /** No longer valid: replaced by a newer pair, or revoked. */
+        revoked: f.boolean({ default: false }),
+        /** Replaced by a newer pair: its refresh token coming back means someone else holds it. */
+        rotated: f.boolean({ default: false }),
+    },
+});
+/** Profile photos and company logos (`images.ts`): small images, their bytes in base64. Private: served by routes. */
+const KoshImage = defineModel('kosh.image', {
+    fields: {
+        ownerModel: f.char({ required: true, index: true }),
+        ownerId: f.integer({ required: true, index: true }),
+        mime: f.char({ required: true }),
+        data: f.text({ required: true }),
+        /** The bytes' digest (16 hex): the version in the image's URL. */
+        hash: f.char({ required: true }),
+    },
+});
 /**
  * The security audit log (CLAUDE.md: logins, permission changes, exports, sensitive actions). Append-only: no one
  * may change or delete events (administrators included: the REST API never serves it, and the admin API only reads).
@@ -196,6 +282,12 @@ export const baseShutro = defineModule({
         AuthApiKey,
         AuthUserGroup,
         AuthUserGrant,
+        AuthPolicy,
+        OAuthApp,
+        OAuthGrant,
+        OAuthCode,
+        OAuthToken,
+        KoshImage,
         AuditEvent,
         SavedView,
     ],
@@ -214,6 +306,12 @@ export const base = defineKoshModule({
         'auth.api_key',
         'auth.user_group',
         'auth.user_grant',
+        'auth.policy',
+        'oauth.app',
+        'oauth.grant',
+        'oauth.code',
+        'oauth.token',
+        'kosh.image',
         'audit.event',
     ],
 });

package/dist/server/auth/oauth.d.ts

@@ -0,0 +1,21 @@
+import type { FastifyInstance } from 'fastify';
+import type { Env, Shutro } from '../orm.js';
+import type { KoshRegistry } from '../registry.js';
+import type { AuthService } from './service.js';
+export declare const ACCESS_SECONDS = 3600;
+/** Access tokens start with it: the server tells them from sessions and API keys at a glance. */
+export declare const ACCESS_PREFIX = "oat_";
+export interface OAuthOptions {
+    /** The back-office's address: the consent page is `<baseUrl>/oauth/authorize`. */
+    readonly baseUrl: string;
+}
+/** A resolved access token: who it acts as, within which scopes. */
+export interface OAuthAccess {
+    readonly token: number;
+    readonly user: number;
+    readonly app: number;
+    readonly scopes: string[];
+}
+/** Finds the access token `token` (`oat_…`), live, of an active app and a grant not revoked. */
+export declare function resolveAccessToken(env: Env, token: string): Promise<OAuthAccess | null>;
+export declare function registerOAuthRoutes(app: FastifyInstance, auth: AuthService, shutro: () => Shutro, registry: KoshRegistry, options: OAuthOptions): void;