Repository navigation
Single-workspace hosts allow creating user-scoped OAuth clients that can never be used #1850
Description
Activity
Looking into this now! Investigating the OAuth client owner constraints on single-workspace hosts (local/desktop) to ensure unusable user-scoped clients are either refused or clamped to org scope with host-appropriate error messaging.
Opened PR with the fix: #1854
Hey @RhysSullivan! #1894 is up for this.
Kept it small: local (
subject === "local") now rejectsowner: "user"instead of writing a client that can never be used. Cloud / multi-workspace subjects are untouched. Also swapped the “Workspace app” mismatch line for a plain org/org message.Happy to change the copy, move the check, or switch to clamp if you’d rather that. Just say which direction you want.
- added a commit that references this issue
on Sep 4, 2026 We're clearing the backlog ahead of the v2 launch, so we're closing this. If it still applies to v2, please open a new issue or PR against v2.
Sent from my Claude
On local/desktop (single org workspace, real LOCAL_SUBJECT), oauth.clients.create accepts owner: "user" clients, but every local connection is org-scoped, so those clients are categorically unusable. The guard then rejects them with cloud vocabulary ("A Workspace connection must use a Workspace app.") on a host that has no Workspace concept.
Fix is either refusing/clamping user client ownership on single-workspace hosts or rewording per host. Split from #1330 (part 3 residual).