Trim OAuth provider migration comments

Author: premtsd-code

src/Migration/Destinations/Appwrite.php

@@ -3552,21 +3552,13 @@ protected function createAuthMethods(AuthMethods $resource): bool
         return true;
     }
 
-    /**
-     * Read-then-merge a single provider's entries on the project's
-     * `oAuthProviders` map, keyed `{providerKey}Appid` / `{providerKey}Secret` /
-     * `{providerKey}Enabled`. The handshake secret is never migrated (see
-     * OAuth2Provider), so `enabled` is propagated as-is and sign-in will fail
-     * until the admin re-enters the secret on the destination.
-     */
     protected function createOAuth2Provider(OAuth2Provider $resource): bool
     {
         $key = $resource->getProviderKey();
         $project = $this->dbForPlatform->getDocument('projects', $this->projectId);
         $oAuthProviders = $project->getAttribute('oAuthProviders', []);
 
         if ($key === 'apple') {
-            // Apple's app id is the serviceId; keyId/teamId ride in the secret JSON blob.
             $serviceId = (string) $resource->getSetting('serviceId');
             if ($serviceId !== '') {
                 $oAuthProviders[$key . 'Appid'] = $serviceId;
@@ -3581,7 +3573,6 @@ protected function createOAuth2Provider(OAuth2Provider $resource): bool
             if ($clientId !== '') {
                 $oAuthProviders[$key . 'Appid'] = $clientId;
             }
-            // Per-shape extras (endpoint/tenant/prompt) ride inside the JSON secret blob.
             foreach (['endpoint', 'tenant', 'prompt'] as $field) {
                 $value = $resource->getSetting($field);
                 if ($value !== null && $value !== '' && $value !== []) {
@@ -3607,10 +3598,7 @@ protected function createOAuth2Provider(OAuth2Provider $resource): bool
     }
 
     /**
-     * Apple stores its credential as a JSON blob of `{keyID, teamID, p8}`.
-     * Migration carries keyID/teamID (readable) but not p8 (write-only).
-     * Read the destination's existing blob, overlay the migrated fields, keep
-     * the destination's `p8` untouched.
+     * Preserve Apple's existing p8 secret while updating readable metadata.
      */
     private function mergeAppleSecret(string $existing, string $keyId, string $teamId): string
     {
@@ -3626,9 +3614,6 @@ private function mergeAppleSecret(string $existing, string $keyId, string $teamI
     }
 
     /**
-     * Merge a partial fields map into a JSON-encoded secret blob, preserving
-     * existing keys on the destination and overriding only the migrated ones.
-     *
      * @param array<string, mixed> $fields
      */
     private function mergeJsonSecret(string $existing, array $fields): string

src/Migration/Resources/Auth/OAuth2/OAuth2Provider.php

@@ -6,30 +6,12 @@
 use Utopia\Migration\Transfer;
 
 /**
- * OAuth2 provider migration resource — one class for every provider. The
- * provider key and that provider's readable (non-secret) field names come from
- * the {@see OAuth2Provider::PROVIDERS} map, not from per-provider subclasses.
- *
- * Only non-secret fields are migrated: the handshake secret (clientSecret, or
- * Apple's p8File) is write-only on the source, so it is not carried across — the
- * destination admin must re-enter it post-migration, after which sign-in works.
- *
- * All providers share Resource::TYPE_OAUTH2_PROVIDER; the destination dispatches
- * per provider on the provider key, not on the concrete type.
+ * OAuth2 provider secrets are write-only and are not migrated.
  */
 final class OAuth2Provider extends Resource
 {
     /**
-     * provider key => the readable, non-secret field names migrated for it.
-     *
-     * This list doubles as the secret allow-list: only these keys are copied off
-     * the (heterogeneous) `listOAuth2Providers` payload, so a secret field the
-     * server may add upstream later is never carried across by accident.
-     *
-     * Destination field routing (see Destinations\Appwrite::createOAuth2Provider):
-     *  - `clientId` / `serviceId` (Apple)   -> `{key}Appid`
-     *  - `endpoint` / `tenant` / `prompt`   -> merged into the `{key}Secret` JSON blob
-     *  - `keyId` / `teamId` (Apple)         -> merged into the Apple secret JSON blob
+     * Allow-list of readable provider fields that are safe to migrate.
      *
      * @var array<string, array<string>>
      */
@@ -78,9 +60,6 @@ final class OAuth2Provider extends Resource
         'zoom' => ['clientId'],
     ];
 
-    /**
-     * @param array<string, mixed> $settings Non-secret fields, keyed per PROVIDERS[$providerKey].
-     */
     public function __construct(
         string $id,
         protected readonly string $providerKey,
@@ -105,11 +84,6 @@ public function getGroup(): string
     }
 
     /**
-     * Build a provider from a single `listOAuth2Providers` entry, copying only
-     * the non-secret fields declared for `$providerKey`. Returns null for a key
-     * this lib has no mapping for yet (e.g. a provider added upstream after this
-     * release), so callers can report it rather than mis-migrate it.
-     *
      * @param array<string, mixed> $array
      */
     public static function fromArray(string $providerKey, array $array): ?self
@@ -174,11 +148,6 @@ public function getSetting(string $field): mixed
         return $this->settings[$field] ?? null;
     }
 
-    /**
-     * Whether the project actually configured this provider — `listOAuth2Providers`
-     * returns every supported provider, but only configured ones are migrated. The
-     * app id is `serviceId` for Apple and `clientId` for everyone else.
-     */
     public function isConfigured(): bool
     {
         return $this->enabled

src/Migration/Sources/Appwrite.php

@@ -393,7 +393,6 @@ private function reportAuth(array $resources, array &$report, array $resourceIds
             $report[Resource::TYPE_AUTH_METHODS] = 1;
         }
 
-        // Count only configured providers, matching exportOAuth2Providers().
         if (\in_array(Resource::TYPE_OAUTH2_PROVIDER, $resources)) {
             $count = 0;
             foreach ($this->project->listOAuth2Providers()->providers ?? [] as $provider) {
@@ -755,12 +754,6 @@ private function exportAuthMethods(): void
         $this->callback([$authMethods]);
     }
 
-    /**
-     * Route each entry of the heterogeneous `listOAuth2Providers` response
-     * through OAuth2Provider, which extracts that provider's readable fields by
-     * key (see OAuth2Provider::PROVIDERS). Secrets come back blanked and are not
-     * migrated.
-     */
     private function exportOAuth2Providers(): void
     {
         $response = $this->project->listOAuth2Providers();
@@ -777,8 +770,6 @@ private function exportOAuth2Providers(): void
             $resource = OAuth2Provider::fromArray($key, $payload);
 
             if ($resource === null) {
-                // Provider with no field mapping yet (added upstream after this
-                // release): report it as non-fatal rather than dropping it silently.
                 $this->addError(new Exception(
                     Resource::TYPE_OAUTH2_PROVIDER,
                     Transfer::GROUP_AUTH,
@@ -788,7 +779,6 @@ private function exportOAuth2Providers(): void
                 continue;
             }
 
-            // The server lists every provider; carry over only configured ones.
             if (!$resource->isConfigured()) {
                 continue;
             }