feat: add oauth provider config

src/wf_config/__init__.py

@@ -2,11 +2,13 @@ from __future__ import annotations
 
 from .loader import load_workflow_config
 from .models import (
+    AuthConfig,
     ClientConfig,
     FilesystemStoreConfig,
     HttpSourceTransportConfig,
     LocalTargetConfig,
     McpSourceConfig,
+    OAuthProviderConfig,
     PythonSourceConfig,
     RpcHttpTargetConfig,
     RpcHttpTransportConfig,
@@ -21,11 +23,13 @@ from .models import (
 
 __all__ = [
     "load_workflow_config",
+    "AuthConfig",
     "ClientConfig",
     "FilesystemStoreConfig",
     "HttpSourceTransportConfig",
     "LocalTargetConfig",
     "McpSourceConfig",
+    "OAuthProviderConfig",
     "PythonSourceConfig",
     "RpcHttpTargetConfig",
     "RpcHttpTransportConfig",

src/wf_config/models.py

@@ -208,7 +208,22 @@ class ServerConfig(WorkflowConfigModel):
         return self.stores.catalog_cache or self.store
 
 
+class OAuthProviderConfig(WorkflowConfigModel):
+    kind: Literal["oauth_authorization_code_pkce"]
+    auth_url: AnyHttpUrl
+    token_url: AnyHttpUrl
+    client_id_env: str
+    client_secret_env: str | None = None
+    scopes: tuple[str, ...] = ()
+    redirect_uri: str = "http://127.0.0.1:0/oauth/callback"
+
+
+class AuthConfig(WorkflowConfigModel):
+    providers: dict[str, OAuthProviderConfig] = Field(default_factory=dict)
+
+
 class WorkflowConfigFile(WorkflowConfigModel):
     version: Literal[1] = 1
     client: ClientConfig = Field(default_factory=ClientConfig)
     server: ServerConfig = Field(default_factory=ServerConfig)
+    auth: AuthConfig = Field(default_factory=AuthConfig)

tests/wf_config/test_config_models.py

@@ -456,3 +456,29 @@ def test_server_config_resolves_missing_role_stores_to_default_store() -> None:
     assert config.server.auth_store.root.as_posix() == ".auth"
     assert config.server.source_registry_store.root.as_posix() == ".default"
     assert config.server.catalog_cache_store.root.as_posix() == ".default"
+
+
+def test_workflow_config_parses_oauth_provider_profile() -> None:
+    config = WorkflowConfigFile.model_validate(
+        {
+            "auth": {
+                "providers": {
+                    "google": {
+                        "kind": "oauth_authorization_code_pkce",
+                        "auth_url": "https://accounts.google.com/o/oauth2/v2/auth",
+                        "token_url": "https://oauth2.googleapis.com/token",
+                        "client_id_env": "GOOGLE_OAUTH_CLIENT_ID",
+                        "client_secret_env": "GOOGLE_OAUTH_CLIENT_SECRET",
+                        "scopes": [
+                            "https://www.googleapis.com/auth/drive.readonly",
+                        ],
+                    }
+                }
+            }
+        }
+    )
+
+    provider = config.auth.providers["google"]
+    assert provider.kind == "oauth_authorization_code_pkce"
+    assert provider.client_id_env == "GOOGLE_OAUTH_CLIENT_ID"
+    assert provider.scopes == ("https://www.googleapis.com/auth/drive.readonly",)