feat(catalog): add OAuth server setup flow

src/api/catalog.test.ts

@@ -33,6 +33,40 @@ describe("registerCatalogServer", () => {
     });
   });
 
+  it("preserves OAuth credentials in the catalog registration body", async () => {
+    let body: unknown;
+    server.use(
+      http.post("*/api/v1/catalog/:catalogId/register", async ({ request }) => {
+        body = await request.json();
+        return HttpResponse.json({ success: true, server_id: "gateway-1", message: "Registered" });
+      }),
+    );
+
+    await registerCatalogServer("github", {
+      oauth_credentials: {
+        grant_type: "authorization_code",
+        issuer: "https://github.com",
+        client_id: "client-id",
+        client_secret: "client-secret", // pragma: allowlist secret
+        authorization_url: "https://github.com/login/oauth/authorize",
+        token_url: "https://github.com/login/oauth/access_token",
+        scopes: ["repo"],
+      },
+    });
+
+    expect(body).toEqual({
+      oauth_credentials: {
+        grant_type: "authorization_code",
+        issuer: "https://github.com",
+        client_id: "client-id",
+        client_secret: "client-secret", // pragma: allowlist secret
+        authorization_url: "https://github.com/login/oauth/authorize",
+        token_url: "https://github.com/login/oauth/access_token",
+        scopes: ["repo"],
+      },
+    });
+  });
+
   it("DELETEs an encoded gateway ID and preserves async lifecycle metadata", async () => {
     let requestPath = "";
     server.use(

src/api/catalog.ts

@@ -7,6 +7,37 @@ import type {
   GatewayTestResponse,
 } from "@/generated/types";
 
+/** Temporary handwritten contract until #6588 reaches generated OpenAPI types. */
+export interface CatalogOAuthCredentials {
+  grant_type: "authorization_code";
+  issuer: string;
+  client_id: string;
+  client_secret: string; // pragma: allowlist secret
+  authorization_url: string;
+  token_url: string;
+  scopes: string[];
+}
+
+export type CatalogOAuthRegisterBody = CatalogServerRegisterBody & {
+  oauth_credentials: CatalogOAuthCredentials;
+};
+
+export interface OAuthUserTokenStatus {
+  status: "valid" | "near_expiry" | "expired" | "missing";
+  authorized: boolean;
+  scopes?: string[];
+  expires_at?: string | null;
+  updated_at?: string | null;
+}
+
+export interface OAuthGatewayStatus {
+  oauth_enabled: boolean;
+  grant_type?: string;
+  user_token_status?: OAuthUserTokenStatus;
+}
+
+export type OAuthGatewayStatusMap = Record<string, OAuthGatewayStatus>;
+
 export interface GatewayImpactPreview {
   gatewayId: string;
   servers: Array<{ id: string; name: string }>;
@@ -17,7 +48,7 @@ export type CatalogGatewayDeleteResponse = GatewayRead | { status?: string; mess
 /** Register a catalog entry through the authenticated BFF proxy. */
 export async function registerCatalogServer(
   catalogId: string,
-  body?: CatalogServerRegisterBody,
+  body?: CatalogServerRegisterBody | CatalogOAuthRegisterBody,
 ): Promise<CatalogServerRegisterResponse> {
   return api.post<CatalogServerRegisterResponse>(
     `/v1/catalog/${encodeURIComponent(catalogId)}/register`,