From 5fe3714edd343e4a44d20841c8f67c445fb69abc Mon Sep 17 00:00:00 2001
From: Carina Wollendorfer <30310907+CarinaWolli@users.noreply.github.com>
Date: Wed, 17 Dec 2025 14:00:12 +0100
Subject: [PATCH] feat: auto skip consent screen for trusted oauth clients
 (#25640)

* auto constent for trusted clients

* add loading state

---------

Co-authored-by: CarinaWolli <wollencarina@gmail.com>
---
 .../modules/auth/oauth2/authorize-view.tsx    | 35 ++++++++++++++++---
 .../migration.sql                             |  2 ++
 packages/prisma/schema.prisma                 |  1 +
 .../routers/viewer/oAuth/getClient.handler.ts |  1 +
 4 files changed, 34 insertions(+), 5 deletions(-)
 create mode 100644 packages/prisma/migrations/20251205111359_add_is_trust_to_o_auth_client/migration.sql

diff --git a/apps/web/modules/auth/oauth2/authorize-view.tsx b/apps/web/modules/auth/oauth2/authorize-view.tsx
index 1f9ba1505a..332d8e8dda 100644
--- a/apps/web/modules/auth/oauth2/authorize-view.tsx
+++ b/apps/web/modules/auth/oauth2/authorize-view.tsx
@@ -69,7 +69,9 @@ export default function Authorize() {
       }
 
       if (client?.redirectUri) {
-        window.location.href = `${client.redirectUri}${client.redirectUri.includes("?") ? "&" : "?"}${errorParams.toString()}`;
+        window.location.href = `${client.redirectUri}${
+          client.redirectUri.includes("?") ? "&" : "?"
+        }${errorParams.toString()}`;
       }
     },
   });
@@ -89,6 +91,18 @@ export default function Authorize() {
     }
   }, [isPendingProfiles]);
 
+  // Auto-authorize trusted clients
+  useEffect(() => {
+    if (client?.isTrusted && selectedAccount) {
+      generateAuthCodeMutation.mutate({
+        clientId: client_id as string,
+        scopes,
+        codeChallenge: code_challenge || undefined,
+        codeChallengeMethod: (code_challenge_method as "S256") || undefined,
+      });
+    }
+  }, [client?.isTrusted, selectedAccount]);
+
   useEffect(() => {
     if (status === "unauthenticated") {
       const urlSearchParams = new URLSearchParams({
@@ -108,9 +122,20 @@ export default function Authorize() {
     return <div>{t("unauthorized")}</div>;
   }
 
+  // Don't show UI for trusted clients, they'll auto-authorize
+  if (client.isTrusted && selectedAccount) {
+    return (
+      <div className="flex justify-center pt-32">
+        <div className="flex items-center space-x-3">
+          <span className="text-lg font-medium text-gray-700">Authorizing...</span>
+        </div>
+      </div>
+    );
+  }
+
   return (
     <div className="flex min-h-screen items-center justify-center">
-      <div className="bg-default border-subtle mt-2 max-w-xl rounded-md border px-9 pb-3 pt-2">
+      <div className="bg-default border-subtle mt-2 max-w-xl rounded-md border px-9 pt-2 pb-3">
         <div className="flex items-center justify-center">
           <Avatar
             alt=""
@@ -127,7 +152,7 @@ export default function Authorize() {
             </div>
           </div>
         </div>
-        <h1 className="px-5 pb-5 pt-3 text-center text-2xl font-bold tracking-tight">
+        <h1 className="px-5 pt-3 pb-5 text-center text-2xl font-bold tracking-tight">
           {t("access_cal_account", { clientName: client.name, appName: APP_NAME })}
         </h1>
         <div className="mb-1 text-sm font-medium">{t("select_account_team")}</div>
@@ -141,7 +166,7 @@ export default function Authorize() {
           defaultValue={selectedAccount || mappedProfiles[0]}
           options={mappedProfiles}
         />
-        <div className="mb-4 mt-5 font-medium">{t("allow_client_to", { clientName: client.name })}</div>
+        <div className="mt-5 mb-4 font-medium">{t("allow_client_to", { clientName: client.name })}</div>
         <ul className="stack-y-4 text-sm">
           <li className="relative pl-5">
             <span className="absolute left-0">&#10003;</span>{" "}
@@ -166,7 +191,7 @@ export default function Authorize() {
             <span className="absolute left-0">&#10003;</span> {t("access_bookings")}
           </li>
         </ul>
-        <div className="bg-subtle mb-8 mt-8 flex rounded-md p-3">
+        <div className="bg-subtle mt-8 mb-8 flex rounded-md p-3">
           <div>
             <Icon name="info" className="mr-1 mt-0.5 h-4 w-4" />
           </div>
diff --git a/packages/prisma/migrations/20251205111359_add_is_trust_to_o_auth_client/migration.sql b/packages/prisma/migrations/20251205111359_add_is_trust_to_o_auth_client/migration.sql
new file mode 100644
index 0000000000..29d712b54b
--- /dev/null
+++ b/packages/prisma/migrations/20251205111359_add_is_trust_to_o_auth_client/migration.sql
@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "public"."OAuthClient" ADD COLUMN     "isTrusted" BOOLEAN NOT NULL DEFAULT false;
diff --git a/packages/prisma/schema.prisma b/packages/prisma/schema.prisma
index cb544bbe9a..cf9cd5e906 100644
--- a/packages/prisma/schema.prisma
+++ b/packages/prisma/schema.prisma
@@ -1765,6 +1765,7 @@ model OAuthClient {
   clientType   OAuthClientType @default(CONFIDENTIAL)
   name         String
   logo         String?
+  isTrusted    Boolean         @default(false)
   accessCodes  AccessCode[]
 }
 
diff --git a/packages/trpc/server/routers/viewer/oAuth/getClient.handler.ts b/packages/trpc/server/routers/viewer/oAuth/getClient.handler.ts
index 9a57b8f6d0..2b5119ac18 100644
--- a/packages/trpc/server/routers/viewer/oAuth/getClient.handler.ts
+++ b/packages/trpc/server/routers/viewer/oAuth/getClient.handler.ts
@@ -18,6 +18,7 @@ export const getClientHandler = async ({ input }: GetClientOptions) => {
       redirectUri: true,
       name: true,
       logo: true,
+      isTrusted: true,
     },
   });
   return client;