Provider OAuth apps

To let users link their Azure / Google account - so Eddytor can enumerate their storage accounts/buckets and discover tables - register an OAuth app per organisation. The client id/secret are stored encrypted in the database (not env vars), so each org brings its own app, and an unconfigured deployment simply returns provider_not_configured (no crash).

Register the app

eddytor set provider-app azure \
  --client-id "<application-client-id>" \
  --client-secret "<client-secret>" \
  --tenant "<directory-tenant-id-or-domain>"   # omit for multi-tenant apps
# or: POST /v1/organisations/<org_id>/provider-apps/azure  (scope provider_apps:write)

Check what's configured (secrets are never returned):

eddytor get provider-app          # all configured providers
eddytor get provider-app azure    # one provider
# or: GET /v1/organisations/<org_id>/provider-apps  (scope provider_apps:read)

Microsoft Entra ID (Azure AD)

1. App registrations → New registration. Name it Eddytor. Single-tenant for org-only, multi-tenant for shared.
2. Redirect URI (Web): ${public_url}/api/v1/auth/providers/azure/callback (replace ${public_url} with your server.public_url).
3. Copy the Application (client) ID (and Directory (tenant) ID for single-tenant).
4. Certificates & secrets → New client secret → copy the value.
5. API permissions → add openid, email, profile, offline_access, User.Read, https://storage.azure.com/user_impersonation, and https://management.azure.com/user_impersonation. Grant admin consent.
6. Store it: eddytor set provider-app azure ….

Google Workspace

1. Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID → Web application.
2. Authorized redirect URI: ${public_url}/api/v1/auth/providers/google/callback.
3. Store it: eddytor set provider-app google … (no tenant).
4. OAuth consent screen → publish (or keep in testing for a closed list). Add the devstorage.full_control + cloud-platform.read-only scopes.

Next

• Per-org provider linking & storage discovery - what users do once the app exists.
• Connect storage - the non-delegated registration paths (keys, SAS, service principal, managed identity).