From: Tim Otten <totten@civicrm.org>
Date: Fri, 23 Oct 2020 05:46:03 +0000 (-0700)
Subject: dev/core#2141 - Schema - Add OAuthClient and OAuthSysToken
X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=c145023afdc2852ff703b61b6eae429c94ca7ed4;hp=2752428e24c10fcac9e0591f3f9230b5eb9498ed;p=civicrm-core.git

dev/core#2141 - Schema - Add OAuthClient and OAuthSysToken

Depends on OAuthProvider and permissions ('manage OAuth client' and 'manage OAuth client secrets')
---

diff --git a/ext/oauth-client/CRM/OAuth/BAO/OAuthClient.php b/ext/oauth-client/CRM/OAuth/BAO/OAuthClient.php
new file mode 100644
index 0000000000..2a70e189b5
--- /dev/null
+++ b/ext/oauth-client/CRM/OAuth/BAO/OAuthClient.php
@@ -0,0 +1,39 @@
+<?php
+/*
+ +--------------------------------------------------------------------+
+ | Copyright CiviCRM LLC. All rights reserved.                        |
+ |                                                                    |
+ | This work is published under the GNU AGPLv3 license with some      |
+ | permitted exceptions and without any warranty. For full license    |
+ | and copyright information, see https://civicrm.org/licensing       |
+ +--------------------------------------------------------------------+
+ */
+
+/**
+ *
+ * @package CRM
+ * @copyright CiviCRM LLC https://civicrm.org/licensing
+ */
+class CRM_OAuth_BAO_OAuthClient extends CRM_OAuth_DAO_OAuthClient {
+
+  /**
+   * Create a new OAuthClient based on array-data
+   *
+   * @param array $params key-value pairs
+   * @return CRM_OAuth_DAO_OAuthClient|NULL
+   *
+   * public static function create($params) {
+   * $className = 'CRM_OAuth_DAO_OAuthClient';
+   * $entityName = 'OAuthClient';
+   * $hook = empty($params['id']) ? 'create' : 'edit';
+   *
+   * CRM_Utils_Hook::pre($hook, $entityName, CRM_Utils_Array::value('id', $params), $params);
+   * $instance = new $className();
+   * $instance->copyValues($params);
+   * $instance->save();
+   * CRM_Utils_Hook::post($hook, $entityName, $instance->id, $instance);
+   *
+   * return $instance;
+   * } */
+
+}
diff --git a/ext/oauth-client/CRM/OAuth/BAO/OAuthSysToken.php b/ext/oauth-client/CRM/OAuth/BAO/OAuthSysToken.php
new file mode 100644
index 0000000000..14402d18dc
--- /dev/null
+++ b/ext/oauth-client/CRM/OAuth/BAO/OAuthSysToken.php
@@ -0,0 +1,59 @@
+<?php
+/*
+ +--------------------------------------------------------------------+
+ | Copyright CiviCRM LLC. All rights reserved.                        |
+ |                                                                    |
+ | This work is published under the GNU AGPLv3 license with some      |
+ | permitted exceptions and without any warranty. For full license    |
+ | and copyright information, see https://civicrm.org/licensing       |
+ +--------------------------------------------------------------------+
+ */
+
+/**
+ *
+ * @package CRM
+ * @copyright CiviCRM LLC https://civicrm.org/licensing
+ */
+class CRM_OAuth_BAO_OAuthSysToken extends CRM_OAuth_DAO_OAuthSysToken {
+
+  private static $returnFields = ['id', 'client_id', 'expires'];
+
+  /**
+   * Create a new OAuthSysToken based on array-data
+   *
+   * @param array $params key-value pairs
+   * @return CRM_OAuth_DAO_OAuthSysToken|NULL
+   *
+   * public static function create($params) {
+   * $className = 'CRM_OAuth_DAO_OAuthSysToken';
+   * $entityName = 'OAuthSysToken';
+   * $hook = empty($params['id']) ? 'create' : 'edit';
+   *
+   * CRM_Utils_Hook::pre($hook, $entityName, CRM_Utils_Array::value('id', $params), $params);
+   * $instance = new $className();
+   * $instance->copyValues($params);
+   * $instance->save();
+   * CRM_Utils_Hook::post($hook, $entityName, $instance->id, $instance);
+   *
+   * return $instance;
+   * } */
+
+  /**
+   * Redact the content of a token.
+   *
+   * This is useful for processes which must internally use the entire token
+   * record -- but then report on their progress to a permissioned party.
+   *
+   * @param array $tokenRecord
+   * @return array
+   */
+  public static function redact($tokenRecord) {
+    if (!\CRM_Core_Permission::check('manage OAuth client secrets')) {
+      return \CRM_Utils_Array::subset($tokenRecord, self::$returnFields);
+    }
+    else {
+      return $tokenRecord;
+    }
+  }
+
+}
diff --git a/ext/oauth-client/CRM/OAuth/DAO/OAuthClient.php b/ext/oauth-client/CRM/OAuth/DAO/OAuthClient.php
new file mode 100644
index 0000000000..0307da99b4
--- /dev/null
+++ b/ext/oauth-client/CRM/OAuth/DAO/OAuthClient.php
@@ -0,0 +1,318 @@
+<?php
+
+/**
+ * @package CRM
+ * @copyright CiviCRM LLC https://civicrm.org/licensing
+ *
+ * Generated from oauth-client/xml/schema/CRM/OAuth/OAuthClient.xml
+ * DO NOT EDIT.  Generated by CRM_Core_CodeGen
+ * (GenCodeChecksum:7487cf595064832b3d55188b3e48bffc)
+ */
+use CRM_OAuth_ExtensionUtil as E;
+
+/**
+ * Database access object for the OAuthClient entity.
+ */
+class CRM_OAuth_DAO_OAuthClient extends CRM_Core_DAO {
+  const EXT = E::LONG_NAME;
+  const TABLE_ADDED = '5.32';
+
+  /**
+   * Static instance to hold the table name.
+   *
+   * @var string
+   */
+  public static $_tableName = 'civicrm_oauth_client';
+
+  /**
+   * Should CiviCRM log any modifications to this table in the civicrm_log table.
+   *
+   * @var bool
+   */
+  public static $_log = FALSE;
+
+  /**
+   * Internal Client ID
+   *
+   * @var int
+   */
+  public $id;
+
+  /**
+   * Provider
+   *
+   * @var string
+   */
+  public $provider;
+
+  /**
+   * Client ID
+   *
+   * @var string
+   */
+  public $guid;
+
+  /**
+   * Client Secret
+   *
+   * @var text
+   */
+  public $secret;
+
+  /**
+   * Extra override options for the service (JSON)
+   *
+   * @var text
+   */
+  public $options;
+
+  /**
+   * Is the client currently enabled?
+   *
+   * @var bool
+   */
+  public $is_active;
+
+  /**
+   * When the client was created.
+   *
+   * @var timestamp
+   */
+  public $created_date;
+
+  /**
+   * When the client was created or modified.
+   *
+   * @var timestamp
+   */
+  public $modified_date;
+
+  /**
+   * Class constructor.
+   */
+  public function __construct() {
+    $this->__table = 'civicrm_oauth_client';
+    parent::__construct();
+  }
+
+  /**
+   * Returns localized title of this entity.
+   *
+   * @param bool $plural
+   *   Whether to return the plural version of the title.
+   */
+  public static function getEntityTitle($plural = FALSE) {
+    return $plural ? E::ts('OAuth Clients') : E::ts('OAuth Client');
+  }
+
+  /**
+   * Returns all the column names of this table
+   *
+   * @return array
+   */
+  public static function &fields() {
+    if (!isset(Civi::$statics[__CLASS__]['fields'])) {
+      Civi::$statics[__CLASS__]['fields'] = [
+        'id' => [
+          'name' => 'id',
+          'type' => CRM_Utils_Type::T_INT,
+          'title' => E::ts('Internal Client ID'),
+          'description' => E::ts('Internal Client ID'),
+          'where' => 'civicrm_oauth_client.id',
+          'table_name' => 'civicrm_oauth_client',
+          'entity' => 'OAuthClient',
+          'bao' => 'CRM_OAuth_DAO_OAuthClient',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'provider' => [
+          'name' => 'provider',
+          'type' => CRM_Utils_Type::T_STRING,
+          'title' => E::ts('Provider'),
+          'description' => E::ts('Provider'),
+          'required' => TRUE,
+          'maxlength' => 128,
+          'size' => CRM_Utils_Type::HUGE,
+          'where' => 'civicrm_oauth_client.provider',
+          'table_name' => 'civicrm_oauth_client',
+          'entity' => 'OAuthClient',
+          'bao' => 'CRM_OAuth_DAO_OAuthClient',
+          'localizable' => 0,
+          'pseudoconstant' => [
+            'callback' => 'CRM_OAuth_BAO_OAuthClient::getProviders',
+          ],
+          'add' => '5.32',
+        ],
+        'guid' => [
+          'name' => 'guid',
+          'type' => CRM_Utils_Type::T_STRING,
+          'title' => E::ts('Client ID'),
+          'description' => E::ts('Client ID'),
+          'required' => TRUE,
+          'maxlength' => 128,
+          'size' => CRM_Utils_Type::HUGE,
+          'where' => 'civicrm_oauth_client.guid',
+          'table_name' => 'civicrm_oauth_client',
+          'entity' => 'OAuthClient',
+          'bao' => 'CRM_OAuth_DAO_OAuthClient',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'secret' => [
+          'name' => 'secret',
+          'type' => CRM_Utils_Type::T_TEXT,
+          'title' => E::ts('Client Secret'),
+          'description' => E::ts('Client Secret'),
+          'where' => 'civicrm_oauth_client.secret',
+          'table_name' => 'civicrm_oauth_client',
+          'entity' => 'OAuthClient',
+          'bao' => 'CRM_OAuth_DAO_OAuthClient',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'options' => [
+          'name' => 'options',
+          'type' => CRM_Utils_Type::T_TEXT,
+          'title' => E::ts('Options'),
+          'description' => E::ts('Extra override options for the service (JSON)'),
+          'where' => 'civicrm_oauth_client.options',
+          'table_name' => 'civicrm_oauth_client',
+          'entity' => 'OAuthClient',
+          'bao' => 'CRM_OAuth_DAO_OAuthClient',
+          'localizable' => 0,
+          'serialize' => self::SERIALIZE_JSON,
+          'add' => '5.32',
+        ],
+        'is_active' => [
+          'name' => 'is_active',
+          'type' => CRM_Utils_Type::T_BOOLEAN,
+          'title' => E::ts('Is Active'),
+          'description' => E::ts('Is the client currently enabled?'),
+          'required' => TRUE,
+          'where' => 'civicrm_oauth_client.is_active',
+          'default' => '1',
+          'table_name' => 'civicrm_oauth_client',
+          'entity' => 'OAuthClient',
+          'bao' => 'CRM_OAuth_DAO_OAuthClient',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'created_date' => [
+          'name' => 'created_date',
+          'type' => CRM_Utils_Type::T_TIMESTAMP,
+          'title' => E::ts('Created Date'),
+          'description' => E::ts('When the client was created.'),
+          'required' => TRUE,
+          'where' => 'civicrm_oauth_client.created_date',
+          'default' => 'CURRENT_TIMESTAMP',
+          'table_name' => 'civicrm_oauth_client',
+          'entity' => 'OAuthClient',
+          'bao' => 'CRM_OAuth_DAO_OAuthClient',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'modified_date' => [
+          'name' => 'modified_date',
+          'type' => CRM_Utils_Type::T_TIMESTAMP,
+          'title' => E::ts('Modified Date'),
+          'description' => E::ts('When the client was created or modified.'),
+          'required' => TRUE,
+          'where' => 'civicrm_oauth_client.modified_date',
+          'default' => 'CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP',
+          'table_name' => 'civicrm_oauth_client',
+          'entity' => 'OAuthClient',
+          'bao' => 'CRM_OAuth_DAO_OAuthClient',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+      ];
+      CRM_Core_DAO_AllCoreTables::invoke(__CLASS__, 'fields_callback', Civi::$statics[__CLASS__]['fields']);
+    }
+    return Civi::$statics[__CLASS__]['fields'];
+  }
+
+  /**
+   * Return a mapping from field-name to the corresponding key (as used in fields()).
+   *
+   * @return array
+   *   Array(string $name => string $uniqueName).
+   */
+  public static function &fieldKeys() {
+    if (!isset(Civi::$statics[__CLASS__]['fieldKeys'])) {
+      Civi::$statics[__CLASS__]['fieldKeys'] = array_flip(CRM_Utils_Array::collect('name', self::fields()));
+    }
+    return Civi::$statics[__CLASS__]['fieldKeys'];
+  }
+
+  /**
+   * Returns the names of this table
+   *
+   * @return string
+   */
+  public static function getTableName() {
+    return self::$_tableName;
+  }
+
+  /**
+   * Returns if this table needs to be logged
+   *
+   * @return bool
+   */
+  public function getLog() {
+    return self::$_log;
+  }
+
+  /**
+   * Returns the list of fields that can be imported
+   *
+   * @param bool $prefix
+   *
+   * @return array
+   */
+  public static function &import($prefix = FALSE) {
+    $r = CRM_Core_DAO_AllCoreTables::getImports(__CLASS__, 'oauth_client', $prefix, []);
+    return $r;
+  }
+
+  /**
+   * Returns the list of fields that can be exported
+   *
+   * @param bool $prefix
+   *
+   * @return array
+   */
+  public static function &export($prefix = FALSE) {
+    $r = CRM_Core_DAO_AllCoreTables::getExports(__CLASS__, 'oauth_client', $prefix, []);
+    return $r;
+  }
+
+  /**
+   * Returns the list of indices
+   *
+   * @param bool $localize
+   *
+   * @return array
+   */
+  public static function indices($localize = TRUE) {
+    $indices = [
+      'UI_provider' => [
+        'name' => 'UI_provider',
+        'field' => [
+          0 => 'provider',
+        ],
+        'localizable' => FALSE,
+        'sig' => 'civicrm_oauth_client::0::provider',
+      ],
+      'UI_guid' => [
+        'name' => 'UI_guid',
+        'field' => [
+          0 => 'guid',
+        ],
+        'localizable' => FALSE,
+        'sig' => 'civicrm_oauth_client::0::guid',
+      ],
+    ];
+    return ($localize && !empty($indices)) ? CRM_Core_DAO_AllCoreTables::multilingualize(__CLASS__, $indices) : $indices;
+  }
+
+}
diff --git a/ext/oauth-client/CRM/OAuth/DAO/OAuthSysToken.php b/ext/oauth-client/CRM/OAuth/DAO/OAuthSysToken.php
new file mode 100644
index 0000000000..3fbbcc9ced
--- /dev/null
+++ b/ext/oauth-client/CRM/OAuth/DAO/OAuthSysToken.php
@@ -0,0 +1,471 @@
+<?php
+
+/**
+ * @package CRM
+ * @copyright CiviCRM LLC https://civicrm.org/licensing
+ *
+ * Generated from oauth-client/xml/schema/CRM/OAuth/OAuthSysToken.xml
+ * DO NOT EDIT.  Generated by CRM_Core_CodeGen
+ * (GenCodeChecksum:1b0fa60330b4ea4a6d30bd972ccf3633)
+ */
+use CRM_OAuth_ExtensionUtil as E;
+
+/**
+ * Database access object for the OAuthSysToken entity.
+ */
+class CRM_OAuth_DAO_OAuthSysToken extends CRM_Core_DAO {
+  const EXT = E::LONG_NAME;
+  const TABLE_ADDED = '5.32';
+
+  /**
+   * Static instance to hold the table name.
+   *
+   * @var string
+   */
+  public static $_tableName = 'civicrm_oauth_systoken';
+
+  /**
+   * Should CiviCRM log any modifications to this table in the civicrm_log table.
+   *
+   * @var bool
+   */
+  public static $_log = FALSE;
+
+  /**
+   * Token ID
+   *
+   * @var int
+   */
+  public $id;
+
+  /**
+   * The tag specifies how this token will be used.
+   *
+   * @var string
+   */
+  public $tag;
+
+  /**
+   * Client ID
+   *
+   * @var int
+   */
+  public $client_id;
+
+  /**
+   * Ex: authorization_code
+   *
+   * @var string
+   */
+  public $grant_type;
+
+  /**
+   * List of scopes addressed by this token
+   *
+   * @var text
+   */
+  public $scopes;
+
+  /**
+   * Ex: Bearer or MAC
+   *
+   * @var string
+   */
+  public $token_type;
+
+  /**
+   * Token to present when accessing resources
+   *
+   * @var text
+   */
+  public $access_token;
+
+  /**
+   * Expiration time for the access_token (seconds since epoch)
+   *
+   * @var int
+   */
+  public $expires;
+
+  /**
+   * Token to present when refreshing the access_token
+   *
+   * @var text
+   */
+  public $refresh_token;
+
+  /**
+   * Identifier for the resource owner. Structure varies by service.
+   *
+   * @var string
+   */
+  public $resource_owner_name;
+
+  /**
+   * Cached details describing the resource owner
+   *
+   * @var text
+   */
+  public $resource_owner;
+
+  /**
+   * List of scopes addressed by this token
+   *
+   * @var text
+   */
+  public $error;
+
+  /**
+   * The token response data, per AccessToken::jsonSerialize
+   *
+   * @var text
+   */
+  public $raw;
+
+  /**
+   * When the client was created.
+   *
+   * @var timestamp
+   */
+  public $created_date;
+
+  /**
+   * When the client was created or modified.
+   *
+   * @var timestamp
+   */
+  public $modified_date;
+
+  /**
+   * Class constructor.
+   */
+  public function __construct() {
+    $this->__table = 'civicrm_oauth_systoken';
+    parent::__construct();
+  }
+
+  /**
+   * Returns localized title of this entity.
+   *
+   * @param bool $plural
+   *   Whether to return the plural version of the title.
+   */
+  public static function getEntityTitle($plural = FALSE) {
+    return $plural ? E::ts('OAuth Sys Tokens') : E::ts('OAuth Sys Token');
+  }
+
+  /**
+   * Returns foreign keys and entity references.
+   *
+   * @return array
+   *   [CRM_Core_Reference_Interface]
+   */
+  public static function getReferenceColumns() {
+    if (!isset(Civi::$statics[__CLASS__]['links'])) {
+      Civi::$statics[__CLASS__]['links'] = static::createReferenceColumns(__CLASS__);
+      Civi::$statics[__CLASS__]['links'][] = new CRM_Core_Reference_Basic(self::getTableName(), 'client_id', 'civicrm_oauth_client', 'id');
+      CRM_Core_DAO_AllCoreTables::invoke(__CLASS__, 'links_callback', Civi::$statics[__CLASS__]['links']);
+    }
+    return Civi::$statics[__CLASS__]['links'];
+  }
+
+  /**
+   * Returns all the column names of this table
+   *
+   * @return array
+   */
+  public static function &fields() {
+    if (!isset(Civi::$statics[__CLASS__]['fields'])) {
+      Civi::$statics[__CLASS__]['fields'] = [
+        'id' => [
+          'name' => 'id',
+          'type' => CRM_Utils_Type::T_INT,
+          'title' => E::ts('Token ID'),
+          'description' => E::ts('Token ID'),
+          'required' => TRUE,
+          'where' => 'civicrm_oauth_systoken.id',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'tag' => [
+          'name' => 'tag',
+          'type' => CRM_Utils_Type::T_STRING,
+          'title' => E::ts('Tag'),
+          'description' => E::ts('The tag specifies how this token will be used.'),
+          'maxlength' => 128,
+          'size' => CRM_Utils_Type::HUGE,
+          'where' => 'civicrm_oauth_systoken.tag',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'client_id' => [
+          'name' => 'client_id',
+          'type' => CRM_Utils_Type::T_INT,
+          'title' => E::ts('Client ID'),
+          'description' => E::ts('Client ID'),
+          'where' => 'civicrm_oauth_systoken.client_id',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'FKClassName' => 'CRM_OAuth_DAO_OAuthClient',
+          'add' => '5.32',
+        ],
+        'grant_type' => [
+          'name' => 'grant_type',
+          'type' => CRM_Utils_Type::T_STRING,
+          'title' => E::ts('Grant type'),
+          'description' => E::ts('Ex: authorization_code'),
+          'maxlength' => 31,
+          'size' => CRM_Utils_Type::MEDIUM,
+          'where' => 'civicrm_oauth_systoken.grant_type',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'scopes' => [
+          'name' => 'scopes',
+          'type' => CRM_Utils_Type::T_TEXT,
+          'title' => E::ts('Scopes'),
+          'description' => E::ts('List of scopes addressed by this token'),
+          'where' => 'civicrm_oauth_systoken.scopes',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'serialize' => self::SERIALIZE_SEPARATOR_BOOKEND,
+          'add' => '5.32',
+        ],
+        'token_type' => [
+          'name' => 'token_type',
+          'type' => CRM_Utils_Type::T_STRING,
+          'title' => E::ts('Token Type'),
+          'description' => E::ts('Ex: Bearer or MAC'),
+          'maxlength' => 128,
+          'size' => CRM_Utils_Type::HUGE,
+          'where' => 'civicrm_oauth_systoken.token_type',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'access_token' => [
+          'name' => 'access_token',
+          'type' => CRM_Utils_Type::T_TEXT,
+          'title' => E::ts('Access Token'),
+          'description' => E::ts('Token to present when accessing resources'),
+          'where' => 'civicrm_oauth_systoken.access_token',
+          'permission' => [
+            [
+              'manage OAuth client secrets',
+            ],
+          ],
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'expires' => [
+          'name' => 'expires',
+          'type' => CRM_Utils_Type::T_INT,
+          'title' => E::ts('Expiration time'),
+          'description' => E::ts('Expiration time for the access_token (seconds since epoch)'),
+          'where' => 'civicrm_oauth_systoken.expires',
+          'default' => '0',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '4.7',
+        ],
+        'refresh_token' => [
+          'name' => 'refresh_token',
+          'type' => CRM_Utils_Type::T_TEXT,
+          'title' => E::ts('Refresh Token'),
+          'description' => E::ts('Token to present when refreshing the access_token'),
+          'where' => 'civicrm_oauth_systoken.refresh_token',
+          'permission' => [
+            [
+              'manage OAuth client secrets',
+            ],
+          ],
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'resource_owner_name' => [
+          'name' => 'resource_owner_name',
+          'type' => CRM_Utils_Type::T_STRING,
+          'title' => E::ts('Resource Owner Name'),
+          'description' => E::ts('Identifier for the resource owner. Structure varies by service.'),
+          'maxlength' => 128,
+          'size' => CRM_Utils_Type::HUGE,
+          'where' => 'civicrm_oauth_systoken.resource_owner_name',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'resource_owner' => [
+          'name' => 'resource_owner',
+          'type' => CRM_Utils_Type::T_TEXT,
+          'title' => E::ts('Resource Owner'),
+          'description' => E::ts('Cached details describing the resource owner'),
+          'where' => 'civicrm_oauth_systoken.resource_owner',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'serialize' => self::SERIALIZE_JSON,
+          'add' => '5.32',
+        ],
+        'error' => [
+          'name' => 'error',
+          'type' => CRM_Utils_Type::T_TEXT,
+          'title' => E::ts('Error'),
+          'description' => E::ts('List of scopes addressed by this token'),
+          'where' => 'civicrm_oauth_systoken.error',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'serialize' => self::SERIALIZE_JSON,
+          'add' => '5.32',
+        ],
+        'raw' => [
+          'name' => 'raw',
+          'type' => CRM_Utils_Type::T_TEXT,
+          'title' => E::ts('Raw token'),
+          'description' => E::ts('The token response data, per AccessToken::jsonSerialize'),
+          'where' => 'civicrm_oauth_systoken.raw',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'serialize' => self::SERIALIZE_JSON,
+          'add' => '5.32',
+        ],
+        'created_date' => [
+          'name' => 'created_date',
+          'type' => CRM_Utils_Type::T_TIMESTAMP,
+          'title' => E::ts('Created Date'),
+          'description' => E::ts('When the client was created.'),
+          'required' => FALSE,
+          'where' => 'civicrm_oauth_systoken.created_date',
+          'default' => 'CURRENT_TIMESTAMP',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+        'modified_date' => [
+          'name' => 'modified_date',
+          'type' => CRM_Utils_Type::T_TIMESTAMP,
+          'title' => E::ts('Modified Date'),
+          'description' => E::ts('When the client was created or modified.'),
+          'required' => FALSE,
+          'where' => 'civicrm_oauth_systoken.modified_date',
+          'default' => 'CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP',
+          'table_name' => 'civicrm_oauth_systoken',
+          'entity' => 'OAuthSysToken',
+          'bao' => 'CRM_OAuth_DAO_OAuthSysToken',
+          'localizable' => 0,
+          'add' => '5.32',
+        ],
+      ];
+      CRM_Core_DAO_AllCoreTables::invoke(__CLASS__, 'fields_callback', Civi::$statics[__CLASS__]['fields']);
+    }
+    return Civi::$statics[__CLASS__]['fields'];
+  }
+
+  /**
+   * Return a mapping from field-name to the corresponding key (as used in fields()).
+   *
+   * @return array
+   *   Array(string $name => string $uniqueName).
+   */
+  public static function &fieldKeys() {
+    if (!isset(Civi::$statics[__CLASS__]['fieldKeys'])) {
+      Civi::$statics[__CLASS__]['fieldKeys'] = array_flip(CRM_Utils_Array::collect('name', self::fields()));
+    }
+    return Civi::$statics[__CLASS__]['fieldKeys'];
+  }
+
+  /**
+   * Returns the names of this table
+   *
+   * @return string
+   */
+  public static function getTableName() {
+    return self::$_tableName;
+  }
+
+  /**
+   * Returns if this table needs to be logged
+   *
+   * @return bool
+   */
+  public function getLog() {
+    return self::$_log;
+  }
+
+  /**
+   * Returns the list of fields that can be imported
+   *
+   * @param bool $prefix
+   *
+   * @return array
+   */
+  public static function &import($prefix = FALSE) {
+    $r = CRM_Core_DAO_AllCoreTables::getImports(__CLASS__, 'oauth_systoken', $prefix, []);
+    return $r;
+  }
+
+  /**
+   * Returns the list of fields that can be exported
+   *
+   * @param bool $prefix
+   *
+   * @return array
+   */
+  public static function &export($prefix = FALSE) {
+    $r = CRM_Core_DAO_AllCoreTables::getExports(__CLASS__, 'oauth_systoken', $prefix, []);
+    return $r;
+  }
+
+  /**
+   * Returns the list of indices
+   *
+   * @param bool $localize
+   *
+   * @return array
+   */
+  public static function indices($localize = TRUE) {
+    $indices = [
+      'UI_tag' => [
+        'name' => 'UI_tag',
+        'field' => [
+          0 => 'tag',
+        ],
+        'localizable' => FALSE,
+        'sig' => 'civicrm_oauth_systoken::0::tag',
+      ],
+    ];
+    return ($localize && !empty($indices)) ? CRM_Core_DAO_AllCoreTables::multilingualize(__CLASS__, $indices) : $indices;
+  }
+
+}
diff --git a/ext/oauth-client/oauth_client.civix.php b/ext/oauth-client/oauth_client.civix.php
index bcdb78cac1..64892d344e 100644
--- a/ext/oauth-client/oauth_client.civix.php
+++ b/ext/oauth-client/oauth_client.civix.php
@@ -473,5 +473,16 @@ function _oauth_client_civix_civicrm_alterSettingsFolders(&$metaDataFolders = NU
  * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_entityTypes
  */
 function _oauth_client_civix_civicrm_entityTypes(&$entityTypes) {
-  $entityTypes = array_merge($entityTypes, []);
+  $entityTypes = array_merge($entityTypes, [
+    'CRM_OAuth_DAO_OAuthClient' => [
+      'name' => 'OAuthClient',
+      'class' => 'CRM_OAuth_DAO_OAuthClient',
+      'table' => 'civicrm_oauth_client',
+    ],
+    'CRM_OAuth_DAO_OAuthSysToken' => [
+      'name' => 'OAuthSysToken',
+      'class' => 'CRM_OAuth_DAO_OAuthSysToken',
+      'table' => 'civicrm_oauth_systoken',
+    ],
+  ]);
 }
diff --git a/ext/oauth-client/sql/auto_install.sql b/ext/oauth-client/sql/auto_install.sql
new file mode 100644
index 0000000000..fd7f643397
--- /dev/null
+++ b/ext/oauth-client/sql/auto_install.sql
@@ -0,0 +1,105 @@
+-- +--------------------------------------------------------------------+
+-- | Copyright CiviCRM LLC. All rights reserved.                        |
+-- |                                                                    |
+-- | This work is published under the GNU AGPLv3 license with some      |
+-- | permitted exceptions and without any warranty. For full license    |
+-- | and copyright information, see https://civicrm.org/licensing       |
+-- +--------------------------------------------------------------------+
+--
+-- Generated from schema.tpl
+-- DO NOT EDIT.  Generated by CRM_Core_CodeGen
+--
+
+
+-- +--------------------------------------------------------------------+
+-- | Copyright CiviCRM LLC. All rights reserved.                        |
+-- |                                                                    |
+-- | This work is published under the GNU AGPLv3 license with some      |
+-- | permitted exceptions and without any warranty. For full license    |
+-- | and copyright information, see https://civicrm.org/licensing       |
+-- +--------------------------------------------------------------------+
+--
+-- Generated from drop.tpl
+-- DO NOT EDIT.  Generated by CRM_Core_CodeGen
+--
+-- /*******************************************************
+-- *
+-- * Clean up the exisiting tables
+-- *
+-- *******************************************************/
+
+SET FOREIGN_KEY_CHECKS=0;
+
+DROP TABLE IF EXISTS `civicrm_oauth_systoken`;
+DROP TABLE IF EXISTS `civicrm_oauth_client`;
+
+SET FOREIGN_KEY_CHECKS=1;
+-- /*******************************************************
+-- *
+-- * Create new tables
+-- *
+-- *******************************************************/
+
+-- /*******************************************************
+-- *
+-- * civicrm_oauth_client
+-- *
+-- *******************************************************/
+CREATE TABLE `civicrm_oauth_client` (
+
+
+     `id` int unsigned  AUTO_INCREMENT  COMMENT 'Internal Client ID',
+     `provider` varchar(128) NOT NULL   COMMENT 'Provider',
+     `guid` varchar(128) NOT NULL   COMMENT 'Client ID',
+     `secret` text    COMMENT 'Client Secret',
+     `options` text    COMMENT 'Extra override options for the service (JSON)',
+     `is_active` tinyint NOT NULL  DEFAULT 1 COMMENT 'Is the client currently enabled?',
+     `created_date` timestamp NOT NULL  DEFAULT CURRENT_TIMESTAMP COMMENT 'When the client was created.',
+     `modified_date` timestamp NOT NULL  DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT 'When the client was created or modified.' 
+,
+        PRIMARY KEY (`id`)
+ 
+    ,     INDEX `UI_provider`(
+        provider
+  )
+  ,     INDEX `UI_guid`(
+        guid
+  )
+  
+ 
+)    ;
+
+-- /*******************************************************
+-- *
+-- * civicrm_oauth_systoken
+-- *
+-- *******************************************************/
+CREATE TABLE `civicrm_oauth_systoken` (
+
+
+     `id` int unsigned NOT NULL AUTO_INCREMENT  COMMENT 'Token ID',
+     `tag` varchar(128)    COMMENT 'The tag specifies how this token will be used.',
+     `client_id` int unsigned    COMMENT 'Client ID',
+     `grant_type` varchar(31)    COMMENT 'Ex: authorization_code',
+     `scopes` text    COMMENT 'List of scopes addressed by this token',
+     `token_type` varchar(128)    COMMENT 'Ex: Bearer or MAC',
+     `access_token` text    COMMENT 'Token to present when accessing resources',
+     `expires` int unsigned   DEFAULT 0 COMMENT 'Expiration time for the access_token (seconds since epoch)',
+     `refresh_token` text    COMMENT 'Token to present when refreshing the access_token',
+     `resource_owner_name` varchar(128)    COMMENT 'Identifier for the resource owner. Structure varies by service.',
+     `resource_owner` text    COMMENT 'Cached details describing the resource owner',
+     `error` text    COMMENT 'List of scopes addressed by this token',
+     `raw` text    COMMENT 'The token response data, per AccessToken::jsonSerialize',
+     `created_date` timestamp NULL  DEFAULT CURRENT_TIMESTAMP COMMENT 'When the client was created.',
+     `modified_date` timestamp NULL  DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP COMMENT 'When the client was created or modified.' 
+,
+        PRIMARY KEY (`id`)
+ 
+    ,     INDEX `UI_tag`(
+        tag
+  )
+  
+,          CONSTRAINT FK_civicrm_oauth_systoken_client_id FOREIGN KEY (`client_id`) REFERENCES `civicrm_oauth_client`(`id`) ON DELETE CASCADE  
+)    ;
+
+ 
\ No newline at end of file
diff --git a/ext/oauth-client/sql/auto_uninstall.sql b/ext/oauth-client/sql/auto_uninstall.sql
new file mode 100644
index 0000000000..db6fecf209
--- /dev/null
+++ b/ext/oauth-client/sql/auto_uninstall.sql
@@ -0,0 +1,23 @@
+-- +--------------------------------------------------------------------+
+-- | Copyright CiviCRM LLC. All rights reserved.                        |
+-- |                                                                    |
+-- | This work is published under the GNU AGPLv3 license with some      |
+-- | permitted exceptions and without any warranty. For full license    |
+-- | and copyright information, see https://civicrm.org/licensing       |
+-- +--------------------------------------------------------------------+
+--
+-- Generated from drop.tpl
+-- DO NOT EDIT.  Generated by CRM_Core_CodeGen
+--
+-- /*******************************************************
+-- *
+-- * Clean up the exisiting tables
+-- *
+-- *******************************************************/
+
+SET FOREIGN_KEY_CHECKS=0;
+
+DROP TABLE IF EXISTS `civicrm_oauth_systoken`;
+DROP TABLE IF EXISTS `civicrm_oauth_client`;
+
+SET FOREIGN_KEY_CHECKS=1;
\ No newline at end of file
diff --git a/ext/oauth-client/xml/schema/CRM/OAuth/OAuthClient.entityType.php b/ext/oauth-client/xml/schema/CRM/OAuth/OAuthClient.entityType.php
new file mode 100644
index 0000000000..21e774a295
--- /dev/null
+++ b/ext/oauth-client/xml/schema/CRM/OAuth/OAuthClient.entityType.php
@@ -0,0 +1,10 @@
+<?php
+// This file declares a new entity type. For more details, see "hook_civicrm_entityTypes" at:
+// https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_entityTypes
+return [
+  [
+    'name' => 'OAuthClient',
+    'class' => 'CRM_OAuth_DAO_OAuthClient',
+    'table' => 'civicrm_oauth_client',
+  ],
+];
diff --git a/ext/oauth-client/xml/schema/CRM/OAuth/OAuthClient.xml b/ext/oauth-client/xml/schema/CRM/OAuth/OAuthClient.xml
new file mode 100644
index 0000000000..9b3649a6f9
--- /dev/null
+++ b/ext/oauth-client/xml/schema/CRM/OAuth/OAuthClient.xml
@@ -0,0 +1,100 @@
+<table>
+  <base>CRM/OAuth</base>
+  <class>OAuthClient</class>
+  <name>civicrm_oauth_client</name>
+  <add>5.32</add>
+  <field>
+    <name>id</name>
+    <title>Internal Client ID</title>
+    <type>int unsigned</type>
+    <comment>Internal Client ID</comment>
+    <add>5.32</add>
+  </field>
+  <primaryKey>
+    <name>id</name>
+    <autoincrement>true</autoincrement>
+  </primaryKey>
+
+  <field>
+    <name>provider</name>
+    <title>Provider</title>
+    <type>varchar</type>
+    <length>128</length>
+    <pseudoconstant>
+      <callback>CRM_OAuth_BAO_OAuthClient::getProviders</callback>
+    </pseudoconstant>
+    <required>true</required>
+    <comment>Provider</comment>
+    <add>5.32</add>
+  </field>
+  <index>
+    <name>UI_provider</name>
+    <fieldName>provider</fieldName>
+    <add>5.32</add>
+  </index>
+
+  <field>
+    <name>guid</name>
+    <title>Client ID</title>
+    <type>varchar</type>
+    <length>128</length>
+    <required>true</required>
+    <comment>Client ID</comment>
+    <add>5.32</add>
+  </field>
+  <index>
+    <name>UI_guid</name>
+    <fieldName>guid</fieldName>
+    <add>5.32</add>
+  </index>
+
+  <field>
+    <name>secret</name>
+    <title>Client Secret</title>
+    <type>text</type>
+    <comment>Client Secret</comment>
+    <add>5.32</add>
+    <!-- Would prefer this be write-only for std admin, and read-write with special/elevated perm -->
+    <!--<permission>-->
+      <!--<or>manage OAuth client secrets</or>-->
+    <!--</permission>-->
+  </field>
+
+  <field>
+    <name>options</name>
+    <type>text</type>
+    <comment>Extra override options for the service (JSON)</comment>
+    <!-- Ex: urlAuthorize, urlAccessToken, urlResourceOwnerDetails, scopes -->
+    <serialize>JSON</serialize>
+    <add>5.32</add>
+  </field>
+
+  <!-- Lifecycle -->
+
+  <field>
+    <name>is_active</name>
+    <title>Is Active</title>
+    <type>boolean</type>
+    <default>1</default>
+    <required>true</required>
+    <comment>Is the client currently enabled?</comment>
+    <add>5.32</add>
+  </field>
+  <field>
+    <name>created_date</name>
+    <type>timestamp</type>
+    <comment>When the client was created.</comment>
+    <required>true</required>
+    <default>CURRENT_TIMESTAMP</default>
+    <add>5.32</add>
+  </field>
+  <field>
+    <name>modified_date</name>
+    <type>timestamp</type>
+    <comment>When the client was created or modified.</comment>
+    <required>true</required>
+    <default>CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP</default>
+    <add>5.32</add>
+  </field>
+
+</table>
diff --git a/ext/oauth-client/xml/schema/CRM/OAuth/OAuthSysToken.entityType.php b/ext/oauth-client/xml/schema/CRM/OAuth/OAuthSysToken.entityType.php
new file mode 100644
index 0000000000..5c53dd6fc1
--- /dev/null
+++ b/ext/oauth-client/xml/schema/CRM/OAuth/OAuthSysToken.entityType.php
@@ -0,0 +1,10 @@
+<?php
+// This file declares a new entity type. For more details, see "hook_civicrm_entityTypes" at:
+// https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_entityTypes
+return [
+  [
+    'name' => 'OAuthSysToken',
+    'class' => 'CRM_OAuth_DAO_OAuthSysToken',
+    'table' => 'civicrm_oauth_systoken',
+  ],
+];
diff --git a/ext/oauth-client/xml/schema/CRM/OAuth/OAuthSysToken.xml b/ext/oauth-client/xml/schema/CRM/OAuth/OAuthSysToken.xml
new file mode 100644
index 0000000000..45fc80ce61
--- /dev/null
+++ b/ext/oauth-client/xml/schema/CRM/OAuth/OAuthSysToken.xml
@@ -0,0 +1,166 @@
+<table>
+  <base>CRM/OAuth</base>
+  <class>OAuthSysToken</class>
+  <name>civicrm_oauth_systoken</name>
+  <add>5.32</add>
+  <field>
+    <name>id</name>
+    <title>Token ID</title>
+    <type>int unsigned</type>
+    <required>true</required>
+    <comment>Token ID</comment>
+    <add>5.32</add>
+  </field>
+  <primaryKey>
+    <name>id</name>
+    <autoincrement>true</autoincrement>
+  </primaryKey>
+
+  <!-- Details based on how the token was requested -->
+
+  <field>
+    <name>tag</name>
+    <title>Tag</title>
+    <type>varchar</type>
+    <length>128</length>
+    <comment>The tag specifies how this token will be used.</comment>
+    <add>5.32</add>
+  </field>
+  <index>
+    <name>UI_tag</name>
+    <fieldName>tag</fieldName>
+    <add>5.32</add>
+  </index>
+
+  <field>
+    <name>client_id</name>
+    <title>Client ID</title>
+    <type>int unsigned</type>
+    <comment>Client ID</comment>
+    <add>5.32</add>
+  </field>
+  <foreignKey>
+    <name>client_id</name>
+    <table>civicrm_oauth_client</table>
+    <key>id</key>
+    <add>5.32</add>
+    <onDelete>CASCADE</onDelete>
+  </foreignKey>
+
+  <field>
+    <name>grant_type</name>
+    <title>Grant type</title>
+    <type>varchar</type>
+    <length>31</length>
+    <!-- FIXME: Pseudoconstant -->
+    <comment>Ex: authorization_code</comment>
+    <add>5.32</add>
+  </field>
+
+  <field>
+    <name>scopes</name>
+    <type>text</type>
+    <comment>List of scopes addressed by this token</comment>
+    <serialize>SEPARATOR_BOOKEND</serialize>
+    <add>5.32</add>
+  </field>
+
+  <!-- Data provided by the authentication server -->
+
+  <field>
+    <name>token_type</name>
+    <title>Token Type</title>
+    <type>varchar</type>
+    <length>128</length>
+    <comment>Ex: Bearer or MAC</comment>
+    <add>5.32</add>
+  </field>
+
+  <field>
+    <name>access_token</name>
+    <title>Access Token</title>
+    <type>text</type>
+    <!-- text or varchar? In theory, if the auth svc uses JWT, tokens can get long -->
+    <permission>
+      <or>manage OAuth client secrets</or>
+    </permission>
+    <comment>Token to present when accessing resources</comment>
+    <add>5.32</add>
+  </field>
+
+  <field>
+    <name>expires</name>
+    <type>int unsigned</type>
+    <title>Expiration time</title>
+    <default>0</default>
+    <comment>Expiration time for the access_token (seconds since epoch)</comment>
+    <add>4.7</add>
+  </field>
+
+  <field>
+    <name>refresh_token</name>
+    <title>Refresh Token</title>
+    <type>text</type>
+    <!-- text or varchar? In theory, if the auth svc uses JWT, tokens can get long -->
+    <permission>
+      <or>manage OAuth client secrets</or>
+    </permission>
+    <comment>Token to present when refreshing the access_token</comment>
+    <add>5.32</add>
+  </field>
+
+  <field>
+    <name>resource_owner_name</name>
+    <title>Resource Owner Name</title>
+    <type>varchar</type>
+    <length>128</length>
+    <comment>Identifier for the resource owner. Structure varies by service.</comment>
+    <add>5.32</add>
+  </field>
+
+  <field>
+    <name>resource_owner</name>
+    <title>Resource Owner</title>
+    <type>text</type>
+    <comment>Cached details describing the resource owner</comment>
+    <serialize>JSON</serialize>
+    <add>5.32</add>
+  </field>
+
+  <field>
+    <name>error</name>
+    <type>text</type>
+    <comment>List of scopes addressed by this token</comment>
+    <serialize>JSON</serialize>
+    <add>5.32</add>
+  </field>
+
+  <field>
+    <name>raw</name>
+    <title>Raw token</title>
+    <type>text</type>
+    <serialize>JSON</serialize>
+    <comment>The token response data, per AccessToken::jsonSerialize</comment>
+    <add>5.32</add>
+  </field>
+
+  <!-- Lifecycle -->
+
+  <field>
+    <name>created_date</name>
+    <type>timestamp</type>
+    <comment>When the client was created.</comment>
+    <required>false</required>
+    <default>CURRENT_TIMESTAMP</default>
+    <add>5.32</add>
+  </field>
+  <field>
+    <name>modified_date</name>
+    <type>timestamp</type>
+    <comment>When the client was created or modified.</comment>
+    <required>false</required>
+    <default>CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP</default>
+    <add>5.32</add>
+  </field>
+
+</table>