fix(oauth): reject user-scoped clients on single-workspace hosts

.changeset/oauth-local-reject-user-client.md

@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Reject user-owned OAuth clients when the subject is local, including before DCR.

packages/core/sdk/src/oauth-flow.test.ts

@@ -263,6 +263,30 @@ describe("oauth.start / oauth.complete", () => {
         }),
       ),
   );
+  it.effect("createClient rejects owner user when subject is local", () =>
+    Effect.gen(function* () {
+      const executor = yield* createExecutor(makeTestConfig({ plugins, subject: "local" }));
+      let seen = false;
+      yield* executor.oauth
+        .createClient({
+          owner: "user",
+          slug: OAuthClientSlug.make("personal"),
+          authorizationUrl: "https://example.com/authorize",
+          tokenUrl: "https://example.com/token",
+          grant: "authorization_code",
+          clientId: "id",
+          clientSecret: "secret",
+        })
+        .pipe(
+          Effect.catchTag("StorageError", (err) => {
+            seen = true;
+            expect(err.message).toContain("User-owned OAuth clients are not supported");
+            return Effect.void;
+          }),
+        );
+      expect(seen).toBe(true);
+    }),
+  );
 
   it.effect("persists HTTP Basic client auth for code exchange and refresh", () =>
     Effect.scoped(
@@ -999,7 +1023,7 @@ describe("oauth.start / oauth.complete", () => {
         );
         expect(Predicate.isTagged("OAuthStartError")(error)).toBe(true);
         const startError = error as OAuthStartError;
-        expect(startError.message).toContain("must use a Workspace app");
+        expect(startError.message).toContain("must use an org-owned OAuth client");
       }),
     ),
   );

packages/core/sdk/src/oauth-service.ts

@@ -878,6 +878,13 @@ export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
     input: CreateOAuthClientInput,
   ): Effect.Effect<OAuthClientSlug, OrgWriteDeniedError | StorageFailure> =>
     Effect.gen(function* () {
+      if (input.owner === "user" && deps.subject === "local") {
+        return yield* new StorageError({
+          message:
+            'User-owned OAuth clients are not supported on single-workspace hosts. Use owner "org" instead.',
+          cause: undefined,
+        });
+      }
       // The `first-party:` namespace is reserved for config-declared apps — a
       // stored row under it would be shadowed by (or worse, impersonate) the
       // host's own app.
@@ -1393,6 +1400,13 @@ export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
     OAuthRegisterDynamicError | OrgWriteDeniedError | StorageFailure
   > =>
     Effect.gen(function* () {
+            if (input.owner === "user" && deps.subject === "local") {
+        return yield* new StorageError({
+          message:
+            'User-owned OAuth clients are not supported on single-workspace hosts. Use owner "org" instead.',
+          cause: undefined,
+        });
+      }
       yield* deps.guardOrgWrite(input.owner);
       const issuer = canonicalDcrIssuer(input.issuer, input.registrationEndpoint);
       // Resolved before the reuse decision: a persisted client registered with
@@ -1665,7 +1679,7 @@ export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
       });
       if (!firstPartyFlow && input.owner === "org" && input.clientOwner === "user") {
         return yield* new OAuthStartError({
-          message: "A Workspace connection must use a Workspace app.",
+          message: "An org connection must use an org-owned OAuth client.",
         });
       }
       // Load the app by its EXPLICIT owner (the caller knows it — no derivation).