Add OAuth providers migration

src/Migration/Destinations/Appwrite.php

@@ -45,6 +45,7 @@
 use Utopia\Migration\Resources\Auth\AuthMethods;
 use Utopia\Migration\Resources\Auth\Hash;
 use Utopia\Migration\Resources\Auth\Membership;
+use Utopia\Migration\Resources\Auth\OAuthProviders;
 use Utopia\Migration\Resources\Auth\Policies;
 use Utopia\Migration\Resources\Auth\Team;
 use Utopia\Migration\Resources\Auth\User;
@@ -259,6 +260,7 @@ public static function getSupportedResources(): array
             Resource::TYPE_TEAM,
             Resource::TYPE_MEMBERSHIP,
             Resource::TYPE_AUTH_METHODS,
+            Resource::TYPE_OAUTH_PROVIDERS,
             Resource::TYPE_POLICIES,
 
             // Database
@@ -2192,6 +2194,10 @@ public function importAuthResource(Resource $resource): Resource
                 /** @var AuthMethods $resource */
                 $this->createAuthMethods($resource);
                 break;
+            case Resource::TYPE_OAUTH_PROVIDERS:
+                /** @var OAuthProviders $resource */
+                $this->createOAuthProviders($resource);
+                break;
             case Resource::TYPE_POLICIES:
                 /** @var Policies $resource */
                 $this->createPolicies($resource);
@@ -3551,6 +3557,36 @@ protected function createAuthMethods(AuthMethods $resource): bool
         return true;
     }
 
+    /**
+     * Read-then-merge the project's `oAuthProviders` map. Each provider expands
+     * into `{key}Enabled` and `{key}Appid` flat entries; the `{key}Secret`
+     * entry is left untouched so the destination user can re-enter it post-migration.
+     */
+    protected function createOAuthProviders(OAuthProviders $resource): bool
+    {
+        $project = $this->dbForPlatform->getDocument('projects', $this->projectId);
+        $oAuthProviders = $project->getAttribute('oAuthProviders', []);
+
+        foreach ($resource->getProviders() as $provider) {
+            $key = $provider['key'];
+            if ($key === '') {
+                continue;
+            }
+            $oAuthProviders[$key . 'Enabled'] = $provider['enabled'];
+            $oAuthProviders[$key . 'Appid']   = $provider['appId'];
+        }
+
+        $this->dbForPlatform->getAuthorization()->skip(fn () => $this->dbForPlatform->updateDocument(
+            'projects',
+            $this->projectId,
+            new UtopiaDocument(['oAuthProviders' => $oAuthProviders]),
+        ));
+
+        $this->dbForPlatform->purgeCachedDocument('projects', $this->projectId);
+
+        return true;
+    }
+
     /**
      * Direct DB write — SDK policy setters reject `total: 0` but `0` is the
      * storage value for "disabled". Shares the `auths` map with

src/Migration/Resource.php

@@ -71,6 +71,8 @@ abstract class Resource implements \JsonSerializable
 
     public const TYPE_AUTH_METHODS = 'auth-methods';
 
+    public const TYPE_OAUTH_PROVIDERS = 'oauth-providers';
+
     public const TYPE_POLICIES = 'policies';
 
     public const TYPE_ENVIRONMENT_VARIABLE = 'environment-variable';
@@ -130,6 +132,7 @@ abstract class Resource implements \JsonSerializable
         self::TYPE_TEAM,
         self::TYPE_MEMBERSHIP,
         self::TYPE_AUTH_METHODS,
+        self::TYPE_OAUTH_PROVIDERS,
         self::TYPE_POLICIES,
         self::TYPE_PLATFORM,
         self::TYPE_API_KEY,

src/Migration/Resources/Auth/OAuthProviders.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace Utopia\Migration\Resources\Auth;
+
+use Utopia\Migration\Resource;
+use Utopia\Migration\Transfer;
+
+/**
+ * Singleton resource representing the project's OAuth2 provider configurations.
+ * One per project; destination merges entries into the project doc's `oAuthProviders`
+ * map. Secrets are never migrated — the source API returns them empty, and the
+ * destination user must re-enter them post-migration.
+ */
+class OAuthProviders extends Resource
+{
+    /**
+     * @param array<array{key: string, enabled: bool, appId: string}> $providers
+     */
+    public function __construct(
+        string $id,
+        private readonly array $providers = [],
+        string $createdAt = '',
+        string $updatedAt = '',
+    ) {
+        $this->id = $id;
+        $this->createdAt = $createdAt;
+        $this->updatedAt = $updatedAt;
+    }
+
+    /**
+     * @param array<string, mixed> $array
+     */
+    public static function fromArray(array $array): self
+    {
+        $providers = [];
+        foreach ($array['providers'] ?? [] as $provider) {
+            $providers[] = [
+                'key' => (string) ($provider['key'] ?? ''),
+                'enabled' => (bool) ($provider['enabled'] ?? false),
+                'appId' => (string) ($provider['appId'] ?? ''),
+            ];
+        }
+
+        return new self(
+            $array['id'],
+            $providers,
+            createdAt: $array['createdAt'] ?? '',
+            updatedAt: $array['updatedAt'] ?? '',
+        );
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function jsonSerialize(): array
+    {
+        return [
+            'id' => $this->id,
+            'providers' => $this->providers,
+            'createdAt' => $this->createdAt,
+            'updatedAt' => $this->updatedAt,
+        ];
+    }
+
+    public static function getName(): string
+    {
+        return Resource::TYPE_OAUTH_PROVIDERS;
+    }
+
+    public function getGroup(): string
+    {
+        return Transfer::GROUP_AUTH;
+    }
+
+    /**
+     * @return array<array{key: string, enabled: bool, appId: string}>
+     */
+    public function getProviders(): array
+    {
+        return $this->providers;
+    }
+}

src/Migration/Sources/Appwrite.php

@@ -26,6 +26,7 @@
 use Utopia\Migration\Resources\Auth\AuthMethods;
 use Utopia\Migration\Resources\Auth\Hash;
 use Utopia\Migration\Resources\Auth\Membership;
+use Utopia\Migration\Resources\Auth\OAuthProviders;
 use Utopia\Migration\Resources\Auth\Policies;
 use Utopia\Migration\Resources\Auth\Team;
 use Utopia\Migration\Resources\Auth\User;
@@ -190,6 +191,7 @@ public static function getSupportedResources(): array
             Resource::TYPE_TEAM,
             Resource::TYPE_MEMBERSHIP,
             Resource::TYPE_AUTH_METHODS,
+            Resource::TYPE_OAUTH_PROVIDERS,
             Resource::TYPE_POLICIES,
 
             // Database
@@ -391,6 +393,11 @@ private function reportAuth(array $resources, array &$report, array $resourceIds
             $report[Resource::TYPE_AUTH_METHODS] = 1;
         }
 
+        if (\in_array(Resource::TYPE_OAUTH_PROVIDERS, $resources)) {
+            // Singleton — one OAuth providers config map per project.
+            $report[Resource::TYPE_OAUTH_PROVIDERS] = 1;
+        }
+
         if (\in_array(Resource::TYPE_POLICIES, $resources)) {
             // Singleton — one policies config per project.
             $report[Resource::TYPE_POLICIES] = 1;
@@ -663,6 +670,20 @@ protected function exportGroupAuth(int $batchSize, array $resources): void
                 previous: $e
             ));
         }
+
+        try {
+            if (\in_array(Resource::TYPE_OAUTH_PROVIDERS, $resources)) {
+                $this->exportOAuthProviders();
+            }
+        } catch (\Throwable $e) {
+            $this->addError(new Exception(
+                Resource::TYPE_OAUTH_PROVIDERS,
+                Transfer::GROUP_AUTH,
+                message: $e->getMessage(),
+                code: (int) $e->getCode() ?: Exception::CODE_INTERNAL,
+                previous: $e
+            ));
+        }
     }
 
     private function exportPolicies(): void
@@ -722,6 +743,33 @@ private function exportAuthMethods(): void
         $this->callback([$authMethods]);
     }
 
+    private function exportOAuthProviders(): void
+    {
+        // listOAuth2Providers returns a heterogeneous list — each entry is a typed
+        // OAuth2{Provider} payload with provider-specific field names (Google's
+        // `clientId` vs Apple's `serviceId`). We only migrate the `enabled` toggle;
+        // credential fields (clientId/secret/serviceId/keyId/...) are intentionally
+        // not migrated — destination user must re-register the OAuth app and
+        // re-enter credentials, same caveat as the SMTP password.
+        $response = $this->project->listOAuth2Providers();
+
+        $providers = [];
+        foreach ($response->providers as $provider) {
+            $providers[] = [
+                'key' => (string) ($provider['$id'] ?? ''),
+                'enabled' => (bool) ($provider['enabled'] ?? false),
+                'appId' => '',
+            ];
+        }
+
+        $oAuthProviders = new OAuthProviders(
+            $this->projectId,
+            $providers,
+        );
+
+        $this->callback([$oAuthProviders]);
+    }
+
     /**
      * @throws AppwriteException
      */

src/Migration/Transfer.php

@@ -38,6 +38,7 @@ class Transfer
         Resource::TYPE_MEMBERSHIP,
         Resource::TYPE_HASH,
         Resource::TYPE_AUTH_METHODS,
+        Resource::TYPE_OAUTH_PROVIDERS,
         Resource::TYPE_POLICIES,
     ];
 
@@ -128,6 +129,7 @@ class Transfer
         Resource::TYPE_TEAM,
         Resource::TYPE_MEMBERSHIP,
         Resource::TYPE_AUTH_METHODS,
+        Resource::TYPE_OAUTH_PROVIDERS,
         Resource::TYPE_POLICIES,
         Resource::TYPE_FILE,
         Resource::TYPE_BUCKET,